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ABSTRACT 


The  Human  Performance  Evaluation  Process  (HPEP)  is  a  resource  for  U.S.  Nuclear  Regulatory 
Commission  inspectors  to  use  when  reviewing  licensee  problem  identification  and  resolution 
programs  with  regard  to  human  performance.  Part  I  provides  a  step-by-step  process  for 
reviewing  licensee  effectiveness  in  identifying,  analyzing  and  resolving  human  performance 
problems.  Part  I  also  addresses  the  challenges  in  identifying  and  investigating  human 
performance  problems,  describes  three  root  cause  analysis  techniques,  and  discusses 
characteristics  of  effective  corrective  action  plans.  Part  II  is  comprised  of  the  HPEP  Cause  Tree 
and  Modules.  The  Cause  Tree  is  a  screening  tool  for  identifying  the  range  of  possible  causes  for 
a  human  performance  problem.  The  Modules  describe  frequently  identified  causes  for  human 
performance  problems  and  provide  examples.  Part  II  is  intended  to  support  the  evaluation  of 
licensee  root  cause  analyses  for  human  performance  problems  identified  in  Part  I. 
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PART  I: 

THE  HUMAN  PERFORMANCE  REVIEW  PROCESS 


M 


1  OVERVIEW  OF  THE  HUMAN  PERFORMANCE 
EVALUATION  PROCESS  (HPEP) 

1.1  INTRODUCTION 

Reliable  human  performance  is  a  requirement  for  safe  operations  in  many  settings,  including 
operations  of  commercial  nuclear  power  and  nuclear  materials  licensees.  Among  the  industries 
regulated  by  the  U.S.  Nuclear  Regulatory  Commission  (NRC),  human  error  has  played  an 
important  role  in  numerous  events.  Researchers  for  the  Electric  Power  Research  Institute  note: 

Ever  since  the  systematic  study  of  human  performance  and  accidents  began,  it  has 
been  clear  that  human  errors  (i.e.,  inappropriate  or  inadequate  human  actions) 
contribute  to  a  large  portion  of  accidents  and  incidents.  This  has  been  found  true 
for  vehicle  operation  (aircraft,  cars,  motorcycles,  bicycles),  for  industry 
(commercial  aviation  maintenance,  manufacturing,  chemical  processing,  mining), 
and  for  electric  power  generation.  In  nuclear  power  generation,  the  portion  of 
events  or  mishaps  attributed  at  least  in  part  to  human  error  has  ranged  from  40% 
to  80%,  depending  on  the  study  and  the  specific  measures  used,  but  it  is 
consistently  reported  as  having  a  major  role  (Gross  and  Ayres,  1998). 

Human  errors  may  play  several  different  roles  in  an  event  sequence.  An  error  may 

•  directly  cause  an  event, 

•  contribute  to  an  event  by  setting  up  the  conditions  that,  in  combination  with  other  events 
or  conditions,  allowed  the  event  to  occur  (e.g.,  leaving  a  valve  open  that  should  be 
closed), 

•  make  the  consequences  of  an  event  more  severe,  or 

•  delay  recovery  from  an  event. 

Human  errors  typically  contribute  to  events  rather  than  directly  cause  them.  In  fact,  a  single 
human  error  directly  causes  very  few  significant  events  because  most  systems  that  involve 
nuclear  processes  are  designed  to  be  fault-tolerant;  that  is,  designed  to  prevent  a  single  human 
action  (or  failure  to  act)  from  causing  an  event  with  important  consequences. 

More  often,  a  risk-significant  event  involves  several  system  deficiencies,  some  of  which  may 
have  happened  long  before  the  event  takes  place.  For  example,  errors  in  the  original  installation 
of  a  system  may  set  the  stage  for  another  human  error  to  initiate  an  event  months  or  years  later. 
The  value  of  investigating  the  human  errors  involved  in  an  event  is  to  understand  what  caused 
them  so  that  corrective  actions  can  be  developed  to  minimize  the  likelihood  of  recurrence. 

It  is  also  important  to  detect  and  correct  patterns  of  errors  before  they  result  in  an  event.  Human 
performance  trends  are  a  pattern  of  related  errors  resulting  from  the  same  causal  factors. 
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Although  most  errors  that  are  made  day-to-day  have  no  immediate  impact  on  safe  operations,  an 
adverse  human  performance  trend  may  contribute  to  an  overall  increase  in  risk  to  the  public.  For 
example,  a  pattern  of  related  errors  may  systematically  degrade  the  reliability  of  a  class  of 
components  (e.g..  miscalibration  errors)  or  the  errors  may  be  committed  in  the  wrong 
combination  of  circumstances  and  cause  an  event. 

In  most  cases,  the  causes  of  errors  that  occur  in  an  event  or  as  part  of  a  trend  (collectively 
referred  to  here  as  human  performance  problems)  can  be  traced  to  weaknesses  in  the 
programs,  policies  and  practices  that  NRC  licensees  use  to  increase  the  reliability  of  human 
performance  in  their  operations.  Examples  of  these  programs  include  training  and  qualification 
programs;  the  fitness-for-duty  program;  programs  to  develop  and  validate  procedures;  work 
planning  and  control  processes;  overtime  policies;  and  structured  methods  for  communicating 
important  information,  such  as  shift  turnover.  Programmatic  weaknesses  are  often  found  to  be 
the  root  causes  of  human  performance  problems. 

In  the  course  of  implementing  NRC  Inspection  Procedure  71 152,  Identification  and  Resolution 
of  Problems,  inspectors  may  be  called  upon  to  validate  licensees'  investigations  of  events 
involving  human  performance  problems.  For  significant  conditions  adverse  to  quality, 
inspectors  will  evaluate  licensees'  detection  and  characterization  of  human  performance 
problems  as  well  as  the  effectiveness  of  licensee  root  cause  analyses  and  corrective  actions.  The 
Human  Performance  Evaluation  Process  (HPEP)  is  intended  to  help  NRC  inspectors  in 
performing  these  tasks. 

1.2  OBJECTIVES 

The  HPEP  is  not  intended  to  replace  existing  NRC  inspection  procedures.  The  purpose  of  the 
HPEP  is  to  support  NRC  staff  reviews  of  the  effectiveness  of  licensee  problem  identification  and 
resolution  programs  in  detecting  and  resolving  human  performance  problems.  Methods  are 
presented  for  evaluating  licensee  investigations  of  human  performance  problems,  root  cause 
analyses  and  corrective  actions.  It  is  recognized  that  the  approach  described  in  Part  II  of  the 
HPEP  is  different  from  that  used  in  NRC  inspection  procedures,  such  as  Inspection  Procedure 
71841,  Human  Performance. 

1.3  ORGANIZATION 

The  HPEP  is  presented  in  two  parts.  Part  I  is  a  step-by-step  process  to  help  a  reviewer  evaluate  a 
licensee’s  problem  identification,  investigation,  causal  analyses  and  corrective  actions  for  human 
performance  problems.  Part  II  is  comprised  of  the  HPEP  Cause  Tree  and  Modules.  The 
modules  provide  background  information  on  frequently  identified  causes  of  human  performance 
problems  and  specific  examples  to  assist  in  the  evaluation  of  a  licensee's  causal  analyses. 

A  glossary  of  terms  and  concepts  that  are  central  to  understanding  and  applying  the  review 
guidance  is  presented  in  Appendix  A.  Terms  that  are  defined  in  the  glossary  are  presented  in 
bold  in  the  text. 


1-3 


Appendix  B  presents  a  bibliography  of  sources  used  to  develop  this  document.  References  are 
not  cited  in  the  text  in  order  to  increase  the  usability  of  the  document. 
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2  HUMAN  PERFORMANCE  PROBLEM  REVIEW 


2.1  OVERVIEW  OF  THE  REVIEW  PROCESS 

In  this  section,  a  systematic  method  is  presented  for  evaluating  the  effectiveness  of  a  licensee’s 
identification  and  resolution  program  with  regard  to  human  performance  problems.  The  HPEP 
review  process  is  organized  as  a  series  of  tables  that  ask  the  inspector  to  answer  evaluation 
questions  in  four  areas.  These  areas  are: 

•  The  licensee’s  identification  and  characterization  of  human  performance  problems  (Table 
2. 1  Problem  Identification  and  Characterization) 

•  Methods  and  information  used  to  investigate  human  performance  (Table  2.2 
Investigation  Methods) 

•  The  analyses  used  to  determine  the  causes  of  the  human  performance  problems 
(Table  2.3  Causal  Analyses) 

•  The  likely  effectiveness  of  corrective  action  plans  (Table  2.4  Corrective  Actions). 

Table  2.5,  Summary  Review  Table,  is  provided  to  assist  in  summarizing  the  results  of  the 
review.  Blank  tables  are  presented  at  the  end  of  this  section  and  in  Appendix  C  for  copying. 

More  detailed  background  information  on  each  of  the  evaluation  areas  is  provided  in  Sections  3- 
6  of  this  document,  as  follows: 

•  Challenges  in  identifying  human  performance  problems  and  the  theoretical  framework 
underlying  the  HPEP  are  discussed  in  Section  3. 

•  Information  and  detailed  guidance  regarding  appropriate  investigation  methods  for 
human  performance  problems  are  presented  in  Section  4. 

•  An  overview  of  root  cause  analysis  is  presented  in  Section  5.  Three  root  cause  analysis 
techniques  are  also  described:  events  and  causal  factors  analysis,  barrier  analysis  and 
change  analysis. 

•  Information  regarding  corrective  actions  for  human  performance  problems  is  presented  in 
Section  6.  This  section  discusses  alternative  methods  of  correcting  human  performance 
problems  and  determining  the  appropriate  scope  of  a  corrective  action  plan. 

The  HPEP  Cause  Tree  and  Modules  are  presented  in  Part  II  of  this  document  to  assist  in 
answering  the  questions  in  Table  2.3,  Causal  Analyses.  This  additional  information  on  typical 
causes  of  human  performance  problems  is  presented  because  determining  the  causes  for  human 
performance  problems  is  often  difficult. 
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2.2  PROBLEM  IDENTIFICATION  AND  CHARACTERIZATION 


The  review  questions  in  Table  2.1  (p.  2-9)  may  be  used  in  evaluating  the  extent  to  which 
licensees  appropriately  identify  and  characterize  human  performance  problems.  Human 
performance  problems  are  sometimes  difficult  to  identify  in  the  documents  that  describe 
problems  at  licensee  facilities  or  may  not  be  identified  at  all.  Licensee  documentation  may  focus 
on  system  or  equipment  performance  without  discussion  of  the  human  actions  and  decisions  that 
contributed  to  the  event  or  condition. 

There  are  a  number  of  reasons  that  human  performance  problems  may  not  be  well  documented  in 
either  internal  licensee  problem  reports  or  in  reports  to  the  NRC.  For  example,  human  errors 
may  not  be  reported  and  documented  as  such  to  avoid  embarrassment  to  personnel  or  possible 
disciplinary  action.  A  more  complete  discussion  of  the  challenges  in  identifying  human 
performance  problems  is  presented  in  Section  3. 

For  some  problems  that  the  licensee  has  identified,  human  actions  and  decisions  may  not  be 
important  contributors  to  the  problem.  In  others,  human  behavior  may  have  been  central  to 
creating  the  problem,  and  an  understanding  of  the  nature  and  causes  of  the  behavior  was 
necessary  to  develop  effective  corrective  actions.  In  the  latter  case,  it  is  important  that  the 
human  performance  problem  was  characterized  in  sufficient  detail  to  support  problem  resolution. 

If  the  licensee  did  not  identify  the  human  performance  problem(s)  in  the  documents  available  for 
review,  it  may  be  necessary  to  request  additional  documents  or  to  interview  licensee  personnel. 
Often,  the  human  performance  problem(s)  in  an  event,  for  example,  were  identified  and 
investigated,  but  the  information  may  not  have  been  included  in  a  formal  report. 

2.3  INVESTIGATION  METHODS 

The  review  questions  in  Table  2.2  (p.  2-10)  may  be  used  to  guide  the  evaluation  of  a  licensee’s 
investigation  of  a  human  performance  problem.  A  thorough  and  systematic  investigation  is 
necessary  to  provide  the  information  needed  to  perform  causal  analyses  and  develop  effective 
corrective  actions. 

In  general,  the  extent  to  which  licensee  personnel  will  investigate  a  human  performance  problem 
depends  upon  the  perceived  significance  of  the  problem.  For  example,  an  error  that  caused  a 
reportable  event  will  likely  receive  more  attention  than  an  error  that  resulted  in  an  event  that  was 
not  reportable.  Many  licensees  have  established  criteria  for  determining  the  types  of  problems 
that  must  be  investigated  and  the  degree  of  thoroughness  required  in  the  investigation.  These 
criteria  may  include  risk,  cost,  or  regulatory  implications,  for  example.  If  a  human  performance 
problem  falls  below  the  licensee’s  threshold  for  conducting  an  investigation  and  the  inspector 
agrees  with  the  licensee’s  determination,  many  of  the  questions  in  Table  2.2  will  be  marked  as 
NA  for  the  problem. 

A  discussion  of  methods  for  investigating  human  performance  problems  can  be  found  in 
Section  4. 
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2.4  CAUSAL  ANALYSES 


The  review  questions  in  Table  2.3  (p.  2-12)  may  be  used  in  evaluating  the  licensee’s  causal 
analyses  of  human  performance  problems.  The  purpose  of  analyzing  the  causes  of  human 
performance  problems  is  to  guide  the  development  of  effective  corrective  actions.  Standard  root 
cause  analysis  techniques,  such  as  events  and  causal  factors  charting  and  analysis,  change 
analysis  and  barrier  analysis,  are  resource-intensive  and  time-consuming  to  apply,  but  yield 
reliable  and  useful  results  when  performed  properly.  Use  of  the  standard  techniques  may  not 
always  be  warranted,  however,  and  licensees  apply  these  techniques  only  to  the  more  significant 
problems.  When  standard  root  cause  analysis  techniques  are  used,  more  than  one  cause  is 
typically  identified  for  a  human  performance  problem.  An  overview  of  root  cause  analysis,  and 
a  discussion  of  the  different  types  of  causes  that  will  be  identified  by  using  root  cause  analysis 
techniques,  can  be  found  in  Section  5. 

More  detailed  information  about  frequently  identified  causes  of  human  performance  problems  is 
presented  in  the  HPEP  Cause  Modules  in  Part  II.  The  HPEP  Cause  Tree  and  Modules  are 
intended  to  assist  inspectors  in  verifying  the  causal  factors  a  licensee  has  identified  as  an  aid  in 
answering  the  questions  in  Table  2.3. 

2.5  CORRECTIVE  ACTIONS 

The  review  questions  in  Table  2.4  (p.  2-14)  may  be  used  in  evaluating  the  licensee’s  corrective 
actions  for  human  performance  problems.  An  effective  corrective  action  for  a  human 
performance  problem  is  one  that  will  decrease  the  likelihood  that  it,  and  similar  problems,  will 
happen  again.  In  an  ideal  world,  an  effective  corrective  action  would  prevent  recurrence  of  the 
human  performance  problem.  As  discussed  in  Section  3,  however,  the  causes  of  human  behavior 
are  difficult  to  identify  and,  as  a  result,  measures  to  improve  human  performance  often  yield 
inconsistent  results. 

Developing  effective  corrective  actions  typically  requires  a  thorough  root  cause  analysis  and  an 
understanding  of  available  methods  for  enhancing  human  performance.  Depending  upon  the 
significance  and  scope  of  the  cause(s)  identified,  corrective  action  plans  may  vary  in  scope  from 
correcting  a  single  cause,  such  as  a  missing  tag  on  a  valve,  to  a  general  organizational 
improvement  plan.  As  a  minimum,  corrective  actions  must  address  each  of  the  causal  factors 
identified  from  the  investigation. 

Corrective  action  plans  that  have  an  appropriate  scope  still  may  be  ineffective,  however. 
Corrective  action  plans  may  be  ineffective  because,  for  example,  the  steps  for  achieving  the 
plan’s  objectives  were  not  defined  in  detail;  responsibility  was  not  assigned  to  specific 
individuals  for  accomplishing  the  actions;  or  measures  for  determining  the  success  of  the 
corrective  actions  were  not  defined  or  used  to  refine  the  plan  when  necessary.  Other 
management  initiatives  and  events  may  arise  that  take  precedence  over  implementing  the 
corrective  actions.  Without  a  method  for  monitoring  the  on-going  effectiveness  of  the  corrective 
action  plan,  human  performance  problems  may  reoccur. 

More  detailed  background  information  about  corrective  action  plans  can  be  found  in  Section  6. 
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2.6  USING  THE  REVIEW  TABLES 


Follow  these  steps  to  use  the  review  tables: 

1 .  Assemble  the  reports  that  describe  the  human  performance  problems  to  be  evaluated. 
These  may  consist  of  Licensee  Event  Reports,  self-assessments,  problem  reports  entered 
into  a  licensee’s  corrective  action  tracking  system(s),  licensee  responses  to  inspection 
findings,  or  others.  Request  that  the  licensee  also  provide  any  related  background  or 
supporting  documentation  that  may  contain  more  information  than  what  is  available  in 
the  reports. 

2.  Identify  each  human  error  or  trend  that  is  described  in  the  documents  and  develop  a  brief, 
shorthand  description  of  the  human  performance  problem.  Focus  on  describing  the 
human  behavior  or  action,  to  the  extent  that  information  is  available.  For  example, 
"procedure  step  skipped,"  "alarm  disabled,"  "jumper  not  removed,"  and  so  on.  Record 
the  brief  description  in  the  top  row  of  each  table,  along  with  the  date  it  occurred,  if  that 
information  is  available.  (If  you  will  be  reviewing  multiple  human  performance 
problems,  make  additional  copies  of  the  tables.  Space  is  provided  on  each  table  to  review 
two  problems.) 

3.  In  the  row  labeled  “Document  Identifier”  at  the  top  of  Table  2.1,  you  may  also  want  to 
record  information  about  the  source  document  in  which  you  found  the  human 
performance  problem  discussed  for  later  reference. 

4.  Begin  the  review  of  each  human  performance  problem  with  Table  2.1  and  continue 
through  Table  2.4.  Answer  the  questions  in  all  of  the  tables  for  each  problem.  If  a 
question  is  not  applicable  to  the  problem,  mark  it  as  NA.  Space  is  provided  in  each  table 
for  recording  notes. 

5.  When  you  have  completed  answering  the  questions  on  the  page,  count  up  and  record  the 
total  number  of  Yes  answers  you  circled  and  the  total  number  of  NA  answers  you  circled 
on  that  page.  Record  these  totals  in  the  spaces  provided  in  the  lower  right-hand  comer  of 
the  page.  The  questions  in  each  table  are  designed  so  that  a  Yes  answer  suggests  problem 
identification  and  resolution  program  effectiveness.  There  is  no  threshold  percentage  of 
Yes  answers  that  would  show  that  a  licensee's  problem  identification  and  resolution 
program  was  ineffective  with  regard  to  human  performance.  However,  these  percentages 
provide  an  indication  of  program  sensitivity  to  human  performance  problems. 

6.  When  you  have  completed  Tables  2. 1  -2.4  for  each  human  performance  problem  under 
review,  summarize  the  results  of  your  evaluations  in  Table  2.5.  By  following  the 
procedure  described  below,  calculate  the  percentage  of  Yes  answers  you  circled  to  the 
applicable  evaluation  questions  in  each  area  addressed  by  the  tables.  Figure  2. 1  shows  an 
example  of  Table  2.5  that  has  been  completed  for  a  hypothetical  inspection. 
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a.  Record  the  total  number  of  human  performance  problems  you  reviewed  in  the 
space  provided  at  the  top  left  of  the  table. 

b.  Multiply  the  number  of  problems  you  reviewed  by  the  number  of  questions  in 
each  table  (the  latter  number  is  provided  in  the  summary  table). 

c.  Add  up  the  total  number  of  Yes  answers  you  circled  in  each  table  and  record 
those  totals  in  Row  C.  For  example,  if  you  used  six  copies  of  Table  2.1  (to  review 
twelve  human  performance  problems),  you  would  add  up  the  Yes  answers  on  all 
of  the  six  pages  to  arrive  at  the  total  number  of  Yes  answers  you  circled  in  Table 
2. 1 .  Record  this  total  in  Row  C  in  the  column  titled  "2. 1  Problem  Identification 
and  Characterization"  on  Table  2.5,  the  "Summary  Review  Table." 

d.  Add  up  the  total  number  of  NA  answers  you  circled  in  each  table  and  record  those 
totals  in  Row  D. 

e.  Subtract  the  total  number  of  NA  answers  (Row  D)  from  the  total  calculated  in 
Row  B.  The  difference  represents  the  number  of  applicable  questions  that  could 
have  been  answered  Yes. 

f.  Divide  the  number  of  Yes  answers  in  each  table  (as  recorded  in  Row  C)  by  the 
number  of  applicable  questions  that  could  have  been  answered  Yes  (as  recorded 
in  Row  E). 

g.  Multiply  the  result  in  Row  F  by  100  to  arrive  at  the  percentage  of  Yes  answers 
you  circled  out  of  the  total  number  of  applicable  questions  that  could  have  been 
answered  Yes. 

h.  Adding  up  your  answers  to  each  question  in  Tables  2. 1-2.4  may  also  be  useful  in 
developing  insights  regarding  any  specific  areas  of  weakness  in  the  licensee’s 
problem  identification  and  resolution  program  with  regard  to  human  performance. 
For  example,  question  2.2.3  in  Table  2.2  asks, "  Did  the  licensee  validate  the 
information  gathered  about  the  problem  by  seeking  information  from  more  than 
one  source?"  If  you  find  that  you  circled  No  for  1 1  out  of  12  problems  reviewed, 
your  answers  may  suggest  that  further  assessment  of  the  licensee’s  investigation 
methods  is  warranted.  Copies  of  the  tables  may  also  be  used  to  record  the  tallies 
for  each  question. 

2.7  ASSESSING  RISK  IMPACT 

There  are  a  number  of  methods  available  for  assessing  the  risk  importance  of  the  human 
performance  problems  reviewed.  The  problem  identification  reports  that  are  reviewed  may  be 
screened  prior  to  the  HPEP  evaluation  to  ensure  that  only  risk-important  events  or  trends  are 
evaluated.  Or,  as  the  HPEP  evaluation  progresses,  the  inspector  may  identify  human 
performance  problems  that  should  be  evaluated  for  risk-significance.  Guidance  for  assessing  the 
risk  impact  of  weaknesses  in  the  licensee’s  problem  identification  and  resolution  processes  with 
regard  to  human  performance  problems  may  also  be  consulted. 

2.8  INCORPORATING  HPEP  FINDINGS  IN  AN  INSPECTION  REPORT 

The  results  of  an  HPEP  review,  taken  together  with  other  information  from  inspection  activities, 
should  assist  NRC  personnel  in  drawing  conclusions  regarding  the  effectiveness  of  a  licensee's 
problem  identification  and  resolution  program  for  human  performance.  For  example,  if  an  HPEP 
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review  indicated  that  a  licensee  identified  and  appropriately  characterized  the  human 
performance  problems  in  only  10%  of  the  issues  reviewed  (as  indicated  by  the  percentage  of  Yes 
answers  calculated  in  Row  G  of  Table  2.5),  inspectors  may  question  the  sensitivity  of  the 
program  to  human  performance  problems.  Or,  if  a  low  percentage  of  Yes  answers  were  given  to 
the  questions  in  Table  2.3  regarding  the  licensee’s  causal  analyses,  inspectors  may  question  the 
likely  effectiveness  of  corrective  actions  based  upon  those  analyses.  Taken  together  with 
additional  information  that  shows  a  pattern  of  undetected  human  performance  trends,  a  low 
percentage  of  Yes  answers  to  the  HPEP  review  questions  could  support  a  finding  that  the 
licensee’s  program  is  weak  in  the  identification  and  resolution  of  human  performance  problems. 
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3  IDENTIFYING  HUMAN  PERFORMANCE  PROBLEMS 

AND  THEIR  CAUSES 


3.1  INTRODUCTION 

Identifying  human  performance  problems  and  their  causes  is  often  difficult.  Further,  the  simple 
identification  of  "human  error”  as  a  root  or  contributing  cause  of  events  provides  little 
information  about  how  to  prevent  similar  problems  from  recurring.  Recognizing  human 
performance  problems  when  they  occur  and  accurately  identifying  their  causes  are  necessary  first 
steps  to  developing  effective  corrective  actions. 

In  this  section,  the  term,  "human  error,”  is  discussed  and  the  challenges  to  identifying  human 
performance  problems  are  discussed.  Common  difficulties  in  identifying  the  causes  of  error  are 
also  discussed.  Finally,  the  framework  for  investigating  human  errors  that  underlies  the  design 
of  the  HPEP  is  presented. 

3.2  CHALLENGES  IN  IDENTIFYING  HUMAN  PERFORMANCE  PROBLEMS 

The  term,  "human  error,"  refers  to  an  interaction  between  human  behavior  and  the  context  in 
which  it  occurs.1  The  concept  of  an  interaction  is  important  because  it  is  the  context  in  which  a 
human  action  takes  place  that  determines  whether  or  not  it  is  an  error.  In  most  cases,  a  particular 
human  action  only  becomes  an  "error"  when  it  deviates  from  what  was  planned  or  expected  in  a 
given  task  environment.  This  definition  of  error  is  important  because  it  directs  attention  both  to 
the  behavior  and  to  the  characteristics  of  the  task  environment  that  allowed  the  behavior  to  cause 
or  contribute  to  an  event. 

The  human  behaviors  of  greatest  concern  in  a  nuclear  power  plant  are  those  in  which  personnel 
interact  with  plant  equipment  and  systems  (i.e.,  human-system  interactions),  such  as 
manipulating  valves,  operating  controls,  placing  or  removing  jumpers,  locating  and  reading 
gauges,  or  making  and  implementing  decisions.  Human-system  interactions  affect  plant 
performance. 

Human  performance  trends,  defined  as  a  pattern  of  related  errors  resulting  from  the  same 
causal  factors,  may  be  difficult  to  identify  for  several  reasons.  First,  humans  commit  errors 


The  term,  "human  error,"  has  become  somewhat  controversial.  Some  practitioners  and  researchers  have  argued 
that  it  inappropriately  focuses  attention  on  workers  as  the  cause  of  an  event  and  carries  a  connotation  of  blame 
(NUREG-1624,  2000;  Reason,  1997).  The  term  is  used  in  this  document,  however,  because  "error"  accurately 
implies  that  the  very  large  majority  of  actions  (or  failures  to  act)  that  cause  or  contribute  to  events  are  unintentional. 
For  blame  to  accrue  to  an  individual  worker,  it  would  be  necessary  to  establish  that  the  worker  had  both  knowledge 
of  the  correct  actions  to  take  in  the  given  context  and  took  the  incorrect  actions  with  intent  (i.e.,  despite  the 
knowledge  that  the  actions  were  proscribed).  If  both  knowledge  and  intent  were  established,  but  the  intent  did  not 
involve  causing  harm,  then  the  more  accurate  term  for  the  worker's  behavior  would  be  a  “violation.”  If  harm  was 
intended,  which  we  are  certain  is  rarely  the  case,  then  the  more  accurate  term  would  be  "sabotage.”  Both  violations 
and  sabotage  fall  outside  the  scope  of  this  document. 
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relatively  frequently  but  the  errors  often  are  not  detected  and  reported  as  such.  Most  are  not 
detected  for  two  primary  reasons:  (1)  they  have  no  impact  on  equipment  or  system  performance, 
or  (2)  they  are  caught  and  corrected  before  they  have  an  impact.  Errors  are  so  common,  in  fact, 
that  people  often  do  not  notice  an  error  has  been  committed  unless  it  results  in  observable 
consequences,  such  as  degraded  equipment,  injuries,  or  equipment  failures. 

Second,  personnel  are  often  reluctant  to  report  their  own  or  co- workers’ errors  for  many  different 
reasons.  These  may  include  the  desire  to  avoid  embarrassment  or  the  potential  for  disciplinary 
action;  “chilling  effects”  from  management  that  discourage  workers  from  reporting  problems;  a 
fear  of  retaliation  or  social  ostracism  from  peers;  the  simple  burden  of  filling  out  paperwork;  or 
there  may  be  no  systematic  and  impersonal  method  available  to  report  errors  and  their  causes. 

As  a  result,  a  pattern  of  repeated  errors  may  not  be  detected  until  they  have  a  noticeable  impact 
on  hardware  performance.  An  accepted  practice  of  deviating  from  the  steps  in  a  poorly  written 
procedure,  rather  than  ensuring  that  the  procedure  is  revised,  is  an  example  of  an  error  that  may 
not  be  reported,  but  could  result  in  adverse  consequences  if,  for  example,  the  deviations  had 
undetected  effects  on  equipment,  such  as  accelerated  aging. 

Third,  some  licensee's  corrective  action  item  tracking  systems  may  not  be  designed  to  support 
the  aggregation  of  human  performance  data  to  identify  trends.  In  some  cases,  problems  are 
coded  and  tracked  by  the  system,  component  or  part,  and  human  errors  that  occurred  to  cause  the 
problem  may  be  buried  in  the  problem  descriptions  and  not  coded  in  a  manner  that  is  retrievable 
for  analysis.  As  a  result,  different  errors  that  result  from  the  same  cause  may  not  be  identified  as 
symptoms  of  an  underlying  problem. 

Finally,  management  and  regulators  may  also  affect  the  human  performance  information  that  is 
reported  and  tracked.  For  example,  some  managers  may  edit  or  influence  the  writing  of  problem 
reports  to  ensure  that  their  departments  are  not  blamed  for  the  problems  or  to  address  economic 
considerations.  Regulatory  interest  in  some  types  of  human  performance  problems  may 
influence  the  types  of  problems  that  are  reported  and  how  they  are  characterized.  The  results 
might  be  that  some  problems  are  under-reported  while  others  may  be  over-reported. 

A  number  of  classification  schemes  have  been  developed  to  categorize  human  errors  into 
different  types.  For  example,  Kirwan  (1994)  identifies  four  types  of  errors,  including  (1)  errors 
of  commission,  in  which  incorrect  actions  were  taken,  (2)  errors  of  omission,  in  which  required 
actions  were  not  taken,  (3)  extraneous  acts,  in  which  an  action  that  was  not  required  was  taken, 
and  (4)  missed  error-recovery  opportunities,  comprised  of  actions  which  could  have  corrected 
previous  errors.  Other  schemes  divide  errors  into  motor  (e.g.,  a  slip)  and  cognitive  (e.g.,  a 
mental  lapse)  categories  that  may  be  further  divided  into  subtypes. 

Error  classification  schemes  that  focus  on  behaviors  provide  a  language  for  describing  the 
different  ways  in  which  human  behavior  in  a  nuclear  licensee's  workplace  can  go  wrong.  But,  as 
will  be  discussed  below,  they  are  not  particularly  useful  for  understanding  the  causes  of  errors 
that  lead  to  events  or  to  on-going  human  performance  problems. 
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3.3  CHALLENGES  IN  IDENTIFYING  THE  CAUSES  OF  ERRORS 


Establishing  the  causes  of  errors  is  necessary  to  detect  and  correct  human  performance  problems, 
but  is  often  more  difficult  than  establishing  the  causes  for  hardware  failures.  The  challenge 
arises  from  the  flexibility  and  adaptability  of  human  behavior  as  well  as  from  the  post  hoc  nature 
of  problem  or  event  investigations. 

There  are  few  simple,  one-to-one  relationships  between  causal  factors  and  specific  human  errors. 
For  example,  a  single  causal  factor,  such  as  fatigue,  may  cause  a  variety  of  different  types  of 
errors,  such  as  skipping  a  step  in  a  procedure,  dropping  tools,  performing  maintenance  on  the 
wrong  valve  or  failing  to  detect  a  sudden  change  in  temperature  or  pressure  on  a  gauge.  Further, 
humans  are  highly  adaptable  and  the  presence  of  a  potential  causal  factor  does  not  guarantee  that 
it  will  cause  an  error  to  be  committed.  Even  a  deeply  fatigued  person  may  be  able  to  sustain  high 
levels  of  accurate  performance  in  some  circumstances,  such  as  in  combat  or  the  operating  room. 
Although  human  factors  research  provides  rules-of-thumb  for  designing  human-system 
interfaces  to  reduce  the  likelihood  of  errors,  and  guidelines  for  the  design  of  tasks  and 
organizations,  the  person  who  is  investigating  an  error  cannot  be  sure  that  the  research  results 
apply  to  the  specific  situation  under  investigation. 

Establishing  causes  for  human  error  in  an  event  sequence  can  be  further  complicated  by 
weaknesses  in  the  evidence  available.  For  example,  although  interview  data  yield  reliable 
information  about  some  lines  of  inquiry,  people  are  notably  limited  in  their  ability  to  know  what 
has  influenced  their  behavior.  The  social  psychological  research  literature  provides  numerous 
examples  of  how  people  create  explanations  for  their  decisions  and  actions  that  bear  little  or  no 
relationship  to  what  can  be  objectively  demonstrated  to  have  caused  them  to  behave  in  a 
particular  way.  In  addition,  interview  data  are  subject  to  various  predictable  biases  and  memory 
distortions  that  reduce  their  reliability.  For  example,  some  research  has  shown  that  the  accuracy 
of  people’s  memories  for  events  decreases  by  about  50%  within  two  days  after  the  event 
occurred.  Moreover,  in  contrast  to  the  equipment  or  materials  involved  in  an  event,  licensee 
investigation  personnel  or  NRC  inspectors  typically  do  not  have  the  option  of  sending  the 
humans  involved  off  to  the  laboratory  for  additional  testing  to  confirm  a  causal  hypothesis. 

The  consequence  of  the  lack  of  a  one-to-one  correspondence  between  different  types  of  errors 
and  specific  causes  is  that  there  is  no  reliable  road  map  to  guide  the  identification  of  an  error's 
causes.  Any  single  error  may  be  caused  by  a  variety  of  factors,  and  the  "true"  cause  of  the  error 
may  be  unknowable  after  the  fact.  Of  course,  there  are  cases  in  which  an  error's  cause  can  be 
determined  unambiguously.  For  example,  if  a  procedure  step  provides  an  incorrect  instruction, 
personnel  report  that  they  followed  the  step,  and  the  consequences  of  their  actions  are  consistent 
with  what  should  have  occurred  from  following  the  incorrect  step,  the  investigator  can  be  fairly 
confident  that  the  "true"  cause  of  the  error  was  in  the  procedure.  However,  those  cases  are  rare. 

Identifying  causes  for  human  error  is  further  complicated  by  many  possible  sources  of  bias  or 
limitations  in  the  investigation  process  itself.  The  choice  of  potential  causes  to  investigate  for  a 
human  error  may  be  influenced,  for  example,  by  the  investigator's  greater  knowledge  of  and 
comfort  level  with  some  causal  factors  over  others  as  well  as  by  a  lack  of  knowledge  in  some 
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areas.  Or,  the  investigation  and  selection  of  causal  factors  may  be  influenced  by  the  anticipated 
costs  of  implementing  subsequent  corrective  actions;  institutional  biases  and  mindsets;  the  time 
and  resources  available  to  conduct  the  investigation;  the  investigators’ perceptions  of  what  will 
be  acceptable  to  management;  and,  sometimes,  communications  from  management  regarding 
acceptable  or  unacceptable  lines  of  inquiry  to  pursue  and  the  “right”  answers  to  the 
investigations’  questions. 

Inherent  biases  in  how  humans  process  information  and  come  to  conclusions  about  causes  may 
also  affect  an  investigation.  For  example,  research  into  the  event  investigation  process  identified 
the  following  ways  in  which  human  information-processing  biases  can  affect  investigations: 

•  There  is  a  general  tendency  to  start  an  investigation  with  a  few  ideas  about  possible 
causes,  and  then  restrict  the  investigation  to  seeking  information  related  to  those  causes. 

It  is  also  common  to  end  the  investigation  before  alternative  causes  have  been  fully 
explored. 

•  People  are  subject  to  what  has  been  termed  the  "confirmation  bias,"  in  which  they  only 
seek  out  information  that  is  consistent  with  an  explanation  and  ignore  disconfirming 
evidence. 

•  Investigators  may  base  their  ideas  of  possible  causes  on  the  most  immediately  available 
and  visible  information  and  neglect  information  that  is  less  obvious. 

•  There  is  a  general  human  tendency  to  attribute  the  cause  of  an  event  to  the  dispositions, 
motivations  or  traits  of  persons  rather  than  to  situational  factors,  so  the  characteristics  of 
the  "actors"  involved  in  an  event  may  be  given  more  weight  as  causal  factors  than  the 
characteristics  of  the  work  environment. 

Because  the  task  of  conclusively  identifying  the  cause(s)  for  an  error  in  an  event  sequence  is  so 
difficult,  a  comprehensive  and  systematic  approach  to  investigating  human  errors  is  necessary. 
The  barrier  analysis  framework  described  below  is  an  approach  to  investigating  human  error  that 
has  been  shown  to  be  useful  in  practice  and  to  lead  to  reliable  results. 

3.4  A  BARRIER  ANALYSIS  FRAMEWORK  FOR  INVESTIGATING  HUMAN 
ERRORS 

The  fact  that  human  performance  is  fallible  is  one  of  the  bases  for  the  "defense-in-depth" 
approach  to  nuclear  power  plant  operations  in  which  multiple  barriers  to  human  error  are 
implemented.  Research  and  industry  experience  have  identified  both  the  most  common  causes 
of  human  error  and  the  barriers  to  error  that  are  effective  in  addressing  these  common  causes. 
Those  responsible  for  safe  operations  implement  programs,  policies  and  processes  to  ensure  that 
these  barriers  are  in-place  and  functioning,  commensurate  with  the  risks  posed  by  the  activities 
involved. 

The  barriers  can  be  grouped  into  four  basic  categories,  as  follows: 

•  Personnel  attributes  required  for  successful  task  performance,  including  fitness  for  duty, 
knowledge  and  skills,  and  attention  and  motivation 
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•  The  resources  provided  to  support  task  performance,  such  as  complete,  technically 
accurate  and  usable  procedures,  accurate  and  complete  reference  documentation, 
appropriate  tools  and  equipment,  supervision  and  the  appropriate  number  of  staff  to 
accomplish  the  work 

•  A  physical  work  environment  compatible  with  human  capabilities,  including  the  design 
of  human-system  interfaces  and  appropriate  controls  on  environmental  factors,  such  as 
noise,  vibration,  and  temperature 

•  An  organizational  work  environment  that  facilitates  task  performance,  including 
effective  verbal  and  written  communications,  inter-group  and  intra-group  coordination, 
an  established  safety  culture,  and  planning  and  scheduling  of  work  activities. 

When  these  barriers  are  in-place  and  functioning,  plant  operations  are  controlled  and  the 
likelihood  of  errors  is  reduced. 

Missing  barriers,  such  as  the  failure  to  hold  a  pre-job  briefing  for  important  work  on  a  safety 
system,  or  deficiencies  in  existing  barriers,  such  as  a  poorly  designed  display,  are  often  found  to 
be  the  direct  causes  of  errors.  Direct  causes  of  errors  are  also  known  as  performance-shaping 
factors. 

Once  an  error  has  been  identified  and  characterized,  the  initial  lines  of  inquiry  into  the  cause(s) 
of  the  error  determine  what  barriers  to  the  error  existed  and  how  they  failed,  and  what  barriers 
could  have  been  implemented  to  prevent  the  error  from  occurring,  but  were  missing.  The  HPEP 
Cause  Modules  in  Part  II  (e.g..  Procedures,  Communications,  Supervision)  represent  the  most 
common  barriers  implemented  at  plants  to  prevent  errors.  The  modules  also  include  examples  of 
the  types  of  direct  causes  that  lead  to  errors  when  the  barriers  fail  or  are  missing. 

3.5  ANALYZING  THE  PROGRAMS  THAT  CREATE  AND  MAINTAIN  BARRIERS 

Although  the  identification  of  missing  or  failed  barriers  to  human  error  is  more  useful  than 
simply  identifying  "human  error"  as  one  of  an  event’s  causes,  stopping  the  investigation  at  this 
level  may  not  provide  sufficient  information  to  develop  effective  corrective  actions.  When  failed 
or  missing  barriers  to  human  error  are  encountered,  it  is  also  important  to  determine  whether  the 
failed  or  missing  barriers  represent  isolated  conditions  or  are  symptoms  of  underlying  flaws  in 
the  plant  programs  intended  to  ensure  that  the  barriers  are  in-place  and  effective. 

The  root  cause  of  an  error  is  often  found  in  programmatic  weaknesses.  Programs  are 
comprised  of  policies  (both  formal  and  informal),  organizational  processes  and  procedures  that 
define  management  expectations  for  how  work  is  to  be  performed.  Some  are  solely  focused  on 
ensuring  safe  operations  (e.g.,  the  ALARA  program  or  the  process  for  developing  emergency 
operating  procedures),  while  others  perform  a  dual  role  (e.g.,  human  resources  and  training 
programs)  or  have  little  direct  impact  on  safety  (e.g.,  the  accounting  system).  If  there  is  a  flaw  in 
one  of  the  programs  responsible  for  maintaining  safe  operations,  that  flaw  will  create  conditions 
that  may  not  only  allow  the  error  under  investigation  to  reoccur,  but  may  represent  a 
vulnerability  to  additional  events  caused  by  the  same  programmatic  flaw.  Programmatic 
weaknesses  are  often  found  to  be  the  cause  of  human  performance  trends. 
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As  a  simple  example,  an  incorrect  step  in  a  procedure  that  is  found  to  have  caused  an  error  may 
represent  an  isolated  problem  in  a  single  procedure.  Or,  there  may  be  a  weakness  in  the  program 
responsible  for  developing  and  maintaining  procedures  that  allowed  not  only  the  one  incorrect 
step  to  be  published,  but  was  ineffective  in  ensuring  that  procedures  overall  were  technically 
accurate.  If  the  investigation  were  to  stop  with  the  identification  of  the  single  incorrect  step,  and 
a  corrective  action  was  taken  to  fix  that  one  step  in  the  single  procedure,  the  underlying  flaw  in 
the  procedures  program  would  not  be  detected.  The  consequence  of  failing  to  detect  and  correct 
the  programmatic  flaw  would  be  that  other  inaccuracies  in  procedures  would  remain.  Further, 
any  new  procedures  that  were  developed  under  the  same  program  could  also  include  technical 
inaccuracies,  thus  setting  the  stage  for  further  errors  that  could  result  in  future  hardware  failures 
and  other  events. 

Tracing  the  root  causes  of  human  error  to  the  programmatic  level  can  be  resource  intensive, 
however.  Licensee  problem  identification  and  resolution  programs  may  not  require  this  type  of 
extensive  investigation  and  analysis  until  a  human  error  is  implicated  in  a  significant  problem  or 
event,  although  definitions  of  "significance"  vary  among  licensees.  Databases  that  allow  the 
tracking  of  human  errors  and  their  direct  causes  may  pinpoint  an  emerging  human  performance 
trend,  however,  and  could  also  lead  to  an  investigation  of  programmatic  causes.  For  this  reason, 
the  HPEP  includes  guidance  for  assessing  a  licensee’s  investigation  of  programmatic  weaknesses 
that  may  be  causing  an  adverse  human  performance  trend  or  that  played  a  causal  or  contributory 
role  in  a  significant  event. 

3.6  SUMMARY 

Figure  3-1  illustrates  the  HPEP  framework  described  in  this  section.  A  hypothetical  event 
sequence  is  shown  across  the  bottom  of  the  figure.  Possible  direct  causes  of  the  human  error 
(barriers  that  failed  or  were  missing)  are  shown  above  the  event  sequence.  Possible 
programmatic  causes  that  may  have  been  responsible  for  the  barrier  failure  are  shown  above  the 
direct  causes,  demonstrating  the  loss  of  operational  control  that  is  evident  from  a  human 
performance  problem  or  significant  event.  In  this  hypothetical  event,  a  person  who  was  not 
qualified  to  perform  the  task  committed  the  error,  and  both  the  training  and  work  control 
programs  were  implicated  as  root  causes. 

The  HPEP,  then,  may  be  used  when  evaluating  a  licensee’s  problem  identification  and  resolution 
program  to  determine  whether  it  (1)  is  effective  in  identifying  the  causes  of  human  performance 
problems  that  play  a  causal  or  contributory  role  in  significant  events,  and  (2)  results  in  corrective 
actions  that  target  the  causes  of  the  problem(s)  and  result  in  effective  problem  resolution. 
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Figure  3.1  HPEP  Framework  EVENT 


4  INVESTIGATION  METHODS  FOR  HUMAN  PERFORMANCE 


4.1  INTRODUCTION 

The  purpose  of  investigating  human  performance  problems  is  to  gather  the  information  necessary 
to  identify  their  causes  and  develop  effective  corrective  actions.  An  investigation  should 
establish  the  "Who,  What,  When,  Where  and  How?"  of  the  human  performance  issue.  The 
causal  analysis  of  the  information  gathered  in  the  investigation  establishes  the  "Why." 

In  general,  the  thoroughness  with  which  an  error  or  a  human  performance  problem  will  be 
investigated  and  analyzed  depends  upon  the  perceived  significance  (e.g.,  safety,  potential 
economic  impact)  of  the  event  sequence  in  which  the  error  occurred  or  the  potential  for  harm  that 
an  adverse  human  performance  trend  presents.  In  addition,  the  role  of  the  error  in  an  event 
sequence  will  also  influence  the  extent  to  which  an  error  is  investigated.  For  example,  an  error 
that  was  the  root  cause  of  an  event  will  likely  receive  more  attention  than  an  error  that  only 
contributed  to  the  event. 

Although  licensees  will  not  thoroughly  investigate  every  human  performance  problem  that 
arises,  a  systematic  investigation  of  significant  problems  provides  the  basis  for  developing 
corrective  actions  to  decrease  the  likelihood  of  recurrence.  The  investigation  should  be 
systematic  to  overcome  the  many  challenges  to  investigating  human  performance  that  were 
discussed  in  Section  3.  A  systematic  investigation  process  assures  that  the  evidence  gathered  is 
complete,  valid  and  reliable.  Evidence  validity  refers  to  the  accuracy  of  the  information. 
Evidence  reliability  refers  to  whether  or  not  different  investigators  would  find  the  same 
information  and  reach  the  same  conclusions  from  it.  A  complete  investigation  identifies  the 
direct,  contributing  and  root  causes  of  the  human  performance  problem  so  that  corrective  actions 
can  be  developed  to  minimize  recurrence  of  the  same  and  similar  problems.  In  this  section, 
methods  for  systematically  investigating  human  performance  problems  are  presented. 

4.2  LINES  OF  INQUIRY 

At  the  beginning  of  an  investigation,  investigators  focus  is  on  establishing  the  basic  facts 
surrounding  the  human  performance  problem.  As  the  investigation  progresses,  the  lines  of 
inquiry  expand  to  investigate  possible  causes  for  the  human  performance  problem  and  the  scope 
of  any  problems  that  are  identified. 

The  initial  lines  of  inquiry  in  an  investigation  help  characterize  the  human  performance  problem. 
Questions  to  be  answered  may  include: 

•  What  were  the  specific  actions  (or  failures  to  act)  that  occurred  in  the  event  or  that 
comprise  the  human  performance  trend? 

•  What  were  the  conditions  under  which  the  actions  occurred? 

•  What  work  activities,  if  any,  were  going  on  at  the  time  of  the  error,  or  that  are  linked  to 
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the  human  performance  problem? 

•  What  systems  or  equipment  were  involved  or  affected  by  the  actions? 

•  When  and  where  did  the  problem  occur? 

•  Who  was  involved  in  the  work  activity  and  who  was  supervising? 

Developing  an  event  chronology  (i.e.,  a  timeline),  or  an  events  and  causal  factors  chart, 
organizes  the  information  gathered  and  is  useful  for  showing  gaps  and  conflicts  in  the 
information  that  has  been  collected.  Events  and  causal  factors  charting  is  discussed  in  Section 
5. 

At  times,  the  information  required  to  develop  the  event  chronology  leads  rapidly  to  identification 
of  the  direct  cause  of  the  human  error  under  investigation.  For  example,  the  evidence  may  show 
that  personnel  were  working  in  a  very  noisy  environment,  wearing  hearing  protection,  and  were 
unable  to  communicate  effectively  —  with  the  result  that  a  communication  error  occurred.  The 
noisy  environment  would  be  the  direct  cause  of  the  error,  in  this  case. 

At  other  times,  the  direct  cause  of  the  error  will  not  be  obvious  and  more  investigation  and 
analysis  may  be  required.  Direct  causes  that  are  commonly  implicated  in  human  performance 
issues  are  described  in  detail  in  the  HPEP  Cause  Modules  in  Part  II  of  this  document.  The  Cause 
Modules  may  suggest  possible  lines  of  inquiry  to  follow  to  establish  the  direct  cause  of  an  error. 
In  addition,  special  tests  or  analyses  may  be  required.  For  example,  interview  data  may  suggest 
that  the  worker  who  committed  the  error  had  been  drinking.  A  blood  or  breath  sample,  if 
available,  may  be  necessary  to  determine  the  validity  of  the  interview  data  and  to  assess  the 
likelihood  that  the  worker  was  impaired. 

Once  the  basic  facts  surrounding  the  human  performance  problem  have  been  established,  the 
lines  of  inquiry  expand  to  begin  identifying  root  and  contributing  causes  for  the  error.  The 
investigator  will  analyze  the  events  and  conditions  leading  up  to  the  error  and  may  use  standard 
causal  analysis  techniques,  such  as  those  discussed  in  Section  5,  to  identify  possible  causal 
factors.  Programmatic  causes  are  investigated  to  determine  whether  a  deficiency  in  a  program, 
policy  or  practices  for  managing  work  activities  at  a  site  allowed  barriers  to  error,  established  by 
management,  to  fail.  As  discussed  in  Section  3,  barriers  may  fail  because  they  are  missing 
altogether  or  there  is  a  weakness  in  how  they  are  implemented. 

The  extent  of  the  conditions  that  caused  the  human  performance  problem  is  also  investigated. 
The  investigator  gathers  evidence  to  determine  whether  the  problem  has  occurred  before,  how 
frequently,  and  whether  the  conditions  that  led  to  this  problem  could  cause  other,  similar  human 
performance  problems  if  not  corrected.  Further,  the  potential  consequences  of  a  recurrence  of 
this  error  under  different  circumstances  should  also  be  evaluated. 

For  an  error  that  was  directly  caused  by  a  miscommunication  in  a  noisy  work  environment,  the 
lines  of  inquiry  to  identify  programmatic  causes  and  the  extent  of  the  conditions  that  caused  the 
communication  error  might  include:  “What  were  the  communication  practices,  if  any,  that 
personnel  were  trained  to  use  in  noisy  environments?  Did  they  follow  those  practices?  If  not, 
why  not?  Were  there  additional  communication  practices  or  devices  that  would  have  allowed  the 
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operators  to  communicate  more  effectively  in  the  noisy  work  environment?  How  many  times  in 
the  past  year  have  communication  errors  occurred  in  this  and  other  noisy  environments?  Are 
there  circumstances  in  which  an  inability  to  communicate  could  increase  plant  risk  to 
unacceptable  levels?" 

For  an  error  that  was  directly  caused  by  fatigue  from  excessive  hours  worked  over  several 
months,  the  investigator  could  ask,  “What  are  the  work  scheduling  and  overtime  practices  at  this 
site?  How  many  times  in  the  past  year  have  hours  in  excess  of  administrative  limits  been 
approved  and  for  how  many  workers?  How  many  extra  work  hours  were  approved  for 
individuals,  for  certain  job  positions,  within  departments?  Is  there  any  evidence  that  error  rates 
increased  during  the  periods  in  which  other  personnel  were  working  excess  hours?  What  kinds 
of  tasks  were  they  performing  and  could  errors  on  those  tasks  increase  plant  risk  to  unacceptable 
levels?” 

The  process  of  establishing  the  event  chronology  and  gathering  the  information  needed  for 
conducting  the  causal  analyses  and  to  identify  the  needed  corrective  actions  is  described 
sequentially  here.  In  most  investigations,  however,  the  investigation  process  is  iterative.  That  is, 
the  answers  to  one  set  of  questions  generate  new  questions  for  which  information  must  be 
gathered.  In  general,  the  more  thorough  the  investigation,  the  more  likely  that  the  causal 
analyses  will  identify  the  correct  causal  factors  for  the  problem  and  that  the  corrective  actions 
will  be  effective. 

4.3  COLLECTING  EVIDENCE 

The  evidence  that  can  be  used  to  investigate  human  performance  problems  falls  into  three 
general  types.  These  are  defined  here  as  physical  evidence,  documentary  evidence  and  human 
evidence.  A  thorough  discussion  of  evidence  collection  and  preservation  methods  is  outside  the 
scope  of  this  document.  Some  of  the  methods  for  and  challenges  in  collecting  and  preserving 
evidence  are  discussed  here,  however,  to  facilitate  review  of  the  licensee’s  investigation. 

Physical  evidence  is  any  matter  (e.g.,  solids,  liquids,  gases)  related  to  the  error  or  human 
performance  problem,  such  as  equipment,  parts,  debris,  contaminated  water,  hardware  or  tools. 
Physical  evidence  may  be  used  to  establish  the  state  or  condition  of  equipment  and  the  work 
environment  prior  to  an  event  as  well  as  to  determine  what  happened  in  the  course  of  the  event. 
For  example,  examination  of  the  personal  protective  equipment  worn  by  the  individuals  involved 
may  show  that  their  ability  to  see  through  a  faceplate  or  to  make  fine  manual  adjustments  in 
gloves  was  limited  and  could  have  contributed  to  an  error.  At  times,  physical  evidence  regarding 
the  state  or  condition  of  the  individuals  involved  in  an  event  may  also  be  collected,  such  as 
collecting  urine  or  blood  samples  to  test  for  the  presence  of  drug  metabolites.  Assuring  that 
perishable  physical  evidence  is  analyzed  before  it  degrades,  and  that  non-perishable  evidence  is 
controlled  so  that  it  is  available  for  further  analysis,  if  necessary,  are  two  important  challenges  in 
gathering  physical  evidence. 

Documentary  evidence  is  also  useful  in  understanding  human  performance  problems,  and 
particularly  any  programmatic  causes  for  an  error.  Documents  regarding  the  work  activity  in 
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which  the  human  performance  problem  occurred  help  to  establish  what  happened,  who  was 
involved  and  the  conditions  under  which  the  problem  arose.  Examples  of  documentary  evidence 
include: 

•  Event  recordings  (e.g.,  event  history,  computer  printouts,  automatic  and  manual  plots  of 
plant  variables  as  a  function  of  time  showing  the  occurrence  of  alarms,  system 
activations,  and  other  conditions  during  the  event).  These  documents  may  show,  for 
example,  the  actions  that  were  taken,  when  they  were  taken  and  any  unusual  conditions 
that  existed  at  the  time. 

•  Design  drawings,  specifications,  design  and  installation  procedures,  modification 
packages.  These  documents  may  be  useful  in  identifying  discrepancies  between  how  a 
system  was  designed  and  how  it  was  functioning  at  the  time  an  error  occurred,  for 
example.  This  information  might  allow  the  investigator  to  determine  whether  personnel 
were  trained  appropriately  and  whether  the  instructions  and  supporting  information  they 
had  available  during  task  performance  were  accurate. 

•  Maintenance  records  for  affected  systems,  including  vendor  manuals.  Maintenance 
records  may  be  useful  in  determining,  for  example,  the  point  in  time  at  which  an  error 
during  maintenance  first  occurred  and,  perhaps,  how  often  it  was  repeated.  Vendor 
manuals  can  be  used  to  verify  that  procedures  are  up-to-date. 

•  Procedures  and  work  orders  used  during  or  relevant  to  the  event.  These  documents  are 
very  useful  in  establishing  what  happened  in  the  event  and  in  identifying  discrepancies 
between  what  was  planned  versus  what  was  implemented. 

•  Plant  technical  specifications  and  associated  safety  analyses.  These  documents  are  often 
useful  in  identifying  discrepancies  between  what  should  have  occurred  versus  what 
actually  happened. 

•  Operations  logs.  Similar  to  event  recordings,  these  documents  may  be  helpful  in 
establishing  what  happened  and  when. 

•  Correspondence,  such  as  e-mails,  letters,  memoranda.  These  documents  may  also 
contain  information  that  is  useful  in  establishing  the  event  timeline,  but  also  often  contain 
important  information  about  the  organizational  work  environment. 

•  Records  of  similar  events,  including  root  causes  and  corrective  actions.  These  documents 
assist  investigators  in  assessing  the  scope  of  the  human  performance  problem  as  well  as 
the  effectiveness  of  previous  corrective  actions  for  similar  human  performance  problems. 

•  Descriptions  of  programs,  processes,  and  practices  addressing  plant  operations  and 
maintenance,  personnel  performance,  and  procedure  development.  These  documents 
often  clarify  programmatic  weaknesses,  such  as  missing  or  weak  barriers  to  error. 

Human  evidence  is  typically  the  primary  source  of  information  about  human  performance 
problems,  and  may  include  written  statements,  the  results  of  interviews,  recordings  of  human 
actions  during  the  event  or  similar  work  activities,  and  the  results  of  event  reconstruction 
activities.  For  example,  audio  or  videotapes  of  the  situation  that  preceded  or  occurred  during  the 
event  can  be  particularly  useful  for  analyzing  an  error,  but  are  usually  not  recorded.  Tapes  of 
similar  work  activities,  such  as  those  made  of  control  room  crews  for  training  purposes,  can  be 
used  to  assess  general  work  practices  and  may  demonstrate  an  on-going  human  performance 
problem,  or  help  to  determine  whether  the  particular  error  that  occurred  in  an  event  is  common. 
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Human  evidence  may  also  include  demonstrations  of  critical  actions,  such  as  manipulations  of 
the  equipment  involved  in  the  event;  walk  through  exercises,  in  which  personnel  act  out 
important  actions  as  the  stages  of  a  scenario  are  described  or  are  directed  by  procedure  steps;  and 
dynamic  exercises,  in  which  scenarios  are  reenacted  under  more  realistic  conditions,  such  as  in  a 
training  simulator.  These  evidence  collection  activities  may  provide  information  about  possible 
task  overload,  for  example,  or  deficiencies  in  the  human-system  interface,  coordination  and 
communication  problems,  knowledge  or  skill  deficiencies,  and  so  on. 

The  participants  in  an  event  are  often  available  to  the  investigator  and  are  typically  able  to 
provide  the  most  detailed  information  about  the  error  that  occurred  or  the  human  performance 
problem.  As  discussed  in  Section  3,  however,  individuals’  memories  for  events  may  be  limited, 
if  they  are  not  interviewed  immediately  after  the  event.  Further,  they  may  not  possess  complete 
information  about  the  event,  because  what  they  remember  will  be  limited  to  the  aspects  of  the 
event  on  which  they  were  focused  at  the  time.  Or,  memory  for  the  event  may  be  distorted  from 
strong  emotion,  the  passage  of  time  and  intervening  thoughts,  by  hearing  others’  descriptions  of 
what  occurred  or  discussing  it  with  them,  the  kinds  of  questions  that  are  asked  during  the 
interview,  and  other  factors.  Licensee  investigators  should  interview  eyewitnesses  who  observed 
the  event  but  did  not  participate  in  it  as  well  as  the  event  participants  as  soon  as  possible  after  the 
event. 

The  information  obtained  from  different  sources  is  often  conflicting.  Further  evidence  collection 
may  resolve  some  conflicts.  As  a  simple  example,  an  operator  may  report  in  an  interview  that  he 
entered  a  room  at  a  particular  time,  but  the  entry  records  for  that  room  show  that  he  keyed  in 
about  15  minutes  later  than  he  reported.  Additional  evidence  regarding  the  accuracy  and 
reliability  of  the  clock  used  when  recording  entries  may  allow  the  investigator  to  conclude  that 
the  entry  log  is  the  more  accurate  information  source.  In  other  instances,  it  may  not  be  possible 
to  collect  additional  evidence  to  resolve  conflicts.  In  these  cases,  investigators  will  have  to 
weigh  the  evidence  and  use  judgment  to  reach  a  conclusion.  For  example,  if  five  eyewitnesses’ 
descriptions  of  an  event  are  consistent,  but  vary  from  the  description  given  by  the  individual  who 
committed  the  error,  the  investigator  might  conclude  that  the  eyewitnesses’  accounts  were  more 
valid. 

It  is  often  the  case,  however,  that  the  evidence  an  investigator  needs  to  conclusively  establish 
what  happened  or  why  an  error  occurred  does  not  exist  or  is  unavailable.  In  these  cases, 
investigators  may  have  to  assume  that  certain  events  occurred  or  conditions  existed  to  explain  the 
error,  or  may  develop  and  analyze  plausible  alternative  scenarios.  Given  that  human 
performance  is  often  so  difficult  to  explain  post  hoc,  it  may  be  possible  to  derive  some  lessons 
learned  from  the  investigation  but  not  to  develop  corrective  actions  that  will  be  effective  in 
minimizing  the  likelihood  that  a  similar  error  will  reoccur. 

As  noted  above,  collecting  evidence  about  a  human  performance  problem  is  an  iterative  process. 
As  answers  to  one  question  are  found,  other  questions  arise  that  require  follow-up.  In  addition, 
new  information  may  shed  a  different  light  on  information  collected  earlier  in  the  investigation 
or  conflict  with  it,  so  that  additional  information  collection  is  necessary. 
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In  general,  the  evidence  gathered  about  a  human  performance  problem  should  enable  licensee 
staff  to  identify  several  possible  causes  for  the  problem.  Plausible  causes  should  be  documented 
and  the  licensee  should  gather  further  evidence  to  confirm  or  rule  out  the  possibilities.  The  most 
plausible  causes  that  were  not  confirmed  by  the  evidence  and  the  basis  for  rejecting  them  should 
also  be  documented. 

4.4  TERMINATING  THE  INVESTIGATION 

The  licensee’s  basis  for  terminating  the  investigation  of  a  human  performance  problem  should 
also  be  documented.  Theoretically,  an  investigation  could  continue  until  every  question  is  fully 
resolved.  Time  and  resources  for  conducting  an  investigation  this  thoroughly  are  usually  not 
available,  however.  Therefore,  other  criteria  may  be  applied  to  determine  when  an  investigation 
should  be  terminated.  These  could  include,  for  example,  a  pre-set  deadline  for  completing  the 
investigation,  reaching  a  dead-end  due  to  the  unavailability  of  further  evidence,  or  a  decision  that 
the  problem  under  investigation  is  minor  and  does  not  warrant  the  expenditure  of  further 
resources.  For  events  that  the  licensee  has  classified  as  significant,  the  investigation  is  typically 
not  terminated  until  the  investigator  and  licensee  management  concur  that  sufficient  evidence  has 
been  gathered  to  support  the  determination  of  the  causes  of  the  human  performance  problem  and 
to  develop  specific  and  effective  corrective  actions. 
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5  EVALUATING  THE  LICENSEE’S  ROOT  CAUSE  ANALYSIS 


5.1  INTRODUCTION 

Root  cause  analysis  is  a  systematic  method  for  analyzing  the  evidence  collected  about  a 
hardware  failure  or  human  performance  problem.  The  purpose  of  root  cause  analysis  is  to 
identify  the  basic  set  of  conditions  that,  if  eliminated  or  modified,  would  minimize  the  likelihood 
of  the  same  and  similar  problems  from  happening  again.  Performing  a  systematic  root  cause 
analysis  and  identifying  the  direct,  contributing  and  root  causes  for  human  performance 
problems  aids  in  ensuring  that  the  problem  is  understood  with  sufficient  depth  to  support  the 
development  of  effective  correction  actions. 

In  this  section,  background  information  for  evaluating  licensees’ root  cause  analyses  of  human 
performance  problems  is  presented.  The  different  types  of  causes  that  may  be  identified  as  a 
result  of  using  root  cause  analysis  techniques  are  discussed,  and  detailed  information  about  three 
commonly  used  root  cause  analysis  techniques  is  presented.  These  techniques  are  events  and 
causal  factors  charting  and  analysis,  change  analysis  and  barrier  analysis. 

5.2  CAUSAL  FACTORS 

A  causal  factor  is  any  action  or  condition  that  occurred  or  existed  prior  to  an  error  without 
which  the  error  is  less  likely  have  occurred.  There  are  three  types  of  causal  factors  that  a  root 
cause  analysis  will  typically  identify.  These  are  the  direct  cause,  contributing  causes  and  root 
causes.  Programmatic  weaknesses  are  also  often  identified  using  root  cause  analysis  techniques, 
and  may  be  determined  to  be  either  contributing  or  root  causes  of  a  human  performance  problem. 
Apparent  causes  for  an  error  may  be  identified  by  a  licensee  in  problem  reports  for  tracking  and 
trending  purposes,  but  are  not  derived  from  applying  a  formal  root  cause  analysis  technique. 

A  direct  cause  is  the  action  or  condition  immediately  preceding  an  error  in  an  event  sequence 
that  caused  or  allowed  the  error  to  occur.  For  example,  consider  a  situation  in  which  an  operator 
silenced  what  he  thought  was  a  nuisance  high  radiation  alarm  from  an  air  monitor  that  had  a 
history  of  spurious  activations.  Within  a  few  minutes,  however,  it  was  discovered  that  the  alarm 
was  valid  when  several  other  air  monitors  in  the  same  area  also  alarmed.  The  error  here  was 
failing  to  confirm  whether  the  alarm  was  valid  before  silencing  it.  The  investigation  and  analysis 
in  this  example  showed  that  the  direct  cause  of  the  error  (i.e.,  the  reason  that  the  operator  did  not 
confirm  the  alarm’s  validity  before  silencing  it)  was  the  operator's  belief  that  the  alarm  was 
invalid,  based  on  its  history  of  spurious  activations.  (Many  other  examples  of  typical  direct 
causes  for  human  errors  can  be  found  in  Part  II  of  this  document,  the  HPEP  Cause  Modules.) 

A  contributing  cause  is  the  actions  or  conditions  that  set  the  stage  for  a  human  performance 
problem  to  occur,  but,  alone,  were  not  sufficient  to  cause  it.  A  contributing  cause  may  be  a  long¬ 
standing  condition  or  a  series  of  prior  events  and  problems  that,  while  unimportant  in 
themselves,  increased  the  probability  of  error.  For  example,  consider  again  the  operator  who 
silenced  the  high  radiation  alarm.  In  this  case,  the  alarm’s  history  of  spurious  activation  would 
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be  a  contributing  cause  for  the  error,  because  it  set  the  stage  for  the  error,  but,  alone,  did  not 
cause  it.  Other  operators  at  the  site  or  at  other  plants  might  have  assessed  conditions  in  the  area 
monitored  before  silencing  the  alarm,  so  the  alarm’s  history  contributed  to  the  operator’s  action 
of  silencing  the  alarm,  but  did  not  fully  explain  it. 

A  root  cause  of  a  human  performance  problem  is  the  set  of  conditions  that,  if  eliminated  or 
modified,  would  minimize  the  likelihood  that  the  problem  would  reoccur  as  well  as  prevent 
similar  problems  from  occurring.  A  root  cause  is  often  responsible  for  multiple  human  errors  or 
hardware  failures,  rather  than  single  problems.  Root  causes  are  more  fundamental  causes  than 
direct  causes,  affect  a  wider  scope  of  work  activities,  are  both  necessary  and  sufficient  to  cause 
the  problem,  and  are  often  the  results  of  programmatic  weaknesses.  In  the  case  of  the  alarm 
error,  a  deficiency  in  alarm  response  procedures,  supervision  or  training  may  have  allowed  a 
practice  to  develop  of  silencing  alarms  without  verifying  conditions.  If  so,  weaknesses  in  the 
procedures  or  training  programs  could  be  a  root  cause  of  the  error  and  some  other  operators  at 
the  plant,  who  use  the  same  procedures  or  have  received  the  same  training,  may  be  likely  to 
commit  the  same  error.  Weaknesses  in  immediate  supervision,  such  as  the  failure  to 
communicate  and  enforce  management  expectations  regarding  alarm  verification  before 
silencing,  could  also  be  a  root  cause  of  the  error. 

A  programmatic  cause  is  a  deficiency  in  one  of  the  licensee's  programs  for  managing  work 
activities  at  a  site  that  allows  human  errors  to  occur  and  may  be  the  root  cause  of  a  single  error  as 
well  as  an  adverse  human  performance  trend.  Licensee  programs,  such  as  the  procedures  and 
training  programs,  overtime  policies  and  practices,  or  the  fitness-for-duty  program,  are 
implemented  by  management  to  create  and  maintain  barriers  to  errors.  When  weaknesses  exist 
in  these  programs,  or  their  implementation  is  flawed,  the  barriers  to  error  they  are  intended  to 
maintain  may  be  ineffective.  In  the  alarm  example  discussed  above,  a  failure  to  emphasize  alarm 
verification,  even  of  nuisance  alarms,  in  the  operator  training  program  would  be  a  programmatic 
cause  of  the  operators  error,  as  well  as  a  possible  root  cause.  Other  examples  of  common 
programmatic  causes  for  human  performance  problems  can  be  found  in  Part  II  of  this  document, 
the  HPEP  Cause  Modules. 

Many  licensees  also  identify  apparent  causes  for  human  performance  problems  that  are  perceived 
as  having  little  individual  significance  but  that  will  be  tracked  to  enable  monitoring  of 
developing  trends.  An  apparent  cause  is  typically  an  estimate  of  the  direct  cause  of  an  event  or 
problem,  based  upon  a  limited  investigation.  An  apparent  cause  is  identified  without  using 
standard  root  cause  analysis  techniques. 

Using  standard  root  cause  analysis  techniques  is  not  a  regulatory  requirement.  The  licensee  is 
required  under  10  CFR  50  Appendix  B  Criteria  XVI  to  prevent  the  recurrence  of  “significant 
conditions  adverse  to  quality,”  however,  and  many  licensees  have  concluded  that  the  use  of 
standard  root  cause  analysis  techniques  is  beneficial  in  understanding  and  correcting  these 
significant  conditions.  Licensees  specify  the  criteria  for  determining  significance,  which  may 
include  issues  of  risk,  regulatory  requirements  and  economic  considerations.  Other  conditions 
that  are  “adverse  to  quality,”  but  do  not  meet  the  licensee’s  significance  criteria,  may  be 
assigned  an  apparent  cause  on  the  basis  of  a  cursory  investigation  and  without  a  formal  root 
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cause  analysis.  In  some  cases,  the  licensee  may  elect  to  track  these  low-risk  conditions  and 
monitor  adverse  trends  for  a  larger  number  of  similar  conditions.  If  the  trending  indicates  a 
common  or  related  cause  for  these  conditions,  then  a  root  cause  determination  may  be  required 
by  the  licensee’s  policy  or  administrative  procedures. 

5.3  OVERVIEW  OF  ROOT  CAUSE  ANALYSIS  TECHNIQUES 

Root  cause  analysis  relies  to  some  extent  on  judgment.  However,  structured  root  cause  analysis 
techniques  provide  step-by-step  procedures  that  can  be  repeated  and  verified.  Clear 
documentation  of  the  analysis  allows  a  reviewer  to  check  its  accuracy  and  completeness. 

Several  root  cause  analysis  methods  that  may  be  used  in  licensee  facilities  are  listed  below: 

•  Events  and  causal  factors  analysis  (to  identify  the  events  and  conditions  that  led  up  to  the 
human  performance  issue) 

•  Change  analysis  (to  identify  changes  in  the  work  environment  since  the  job  was  last 
performed  successfully  that  may  have  caused  or  contributed  to  the  problem) 

•  Barrier  analysis  (to  identify  the  barriers  that,  if  present  or  strengthened,  would  have 
prevented  the  human  performance  issue  from  occurring) 

•  Management  Oversight  and  Risk  Tree  (MORT)  analysis  (to  systematically  check  that  all 
possible  causes  of  problems  have  been  considered) 

•  Critical  incident  techniques  (to  identify  critical  actions  that,  if  performed  correctly,  would 
have  prevented  the  event  from  occurring  or  would  have  significantly  reduced  its 
consequences) 

•  Fault  tree  analysis  (to  identify  relationships  among  events  and  the  probability  of  event 
occurrence) 

In  general,  a  root  cause  analysis  repeatedly  asks  the  question  "Why?"  about  the  events  and 
conditions  that  caused  or  contributed  to  the  human  performance  problem. 

Once  the  evidence  has  been  gathered  and  the  important  causes  for  the  human  performance 
problem  have  been  identified,  the  root  cause  analysis  then  looks  for  any  relationships  among  the 
causes.  The  root  cause  analysis  determines  whether  the  causal  factors  demonstrate  any  order  or 
precedence,  either  in  terms  of  time  or  scope  of  effect.  If  one  causal  factor  preceded  another  in 
time  and  affected  it,  or  if  a  causal  factor  accounted  for  more  than  one  of  the  human  errors  that 
occurred  in  an  event  sequence  or  among  those  comprising  an  adverse  human  performance  trend, 
it  is  a  candidate  root  cause.  The  goal  of  the  analysis  is  to  determine  which  causal  factor(s),  if 
corrected,  would  prevent  the  recurrence  of  the  same  and  similar  errors.  Events  and  causal  factors 
charting  and  analysis,  change  analysis  and  barrier  analysis  work  well  together  to  ensure  that  all 
causal  factors  are  identified. 

5.4  EVENTS  AND  CAUSAL  FACTORS  CHARTING  AND  ANALYSIS 

Events  and  causal  factors  charting  and  analysis  is  a  method  for  organizing  and  analyzing  the 
evidence  gathered  during  an  investigation.  An  events  and  causal  factors  (ECF)  chart  graphically 
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displays  the  events  and  conditions  associated  with  an  occurrence  (e.g.,  an  error,  a  significant 
event,  a  human  performance  problem)  the  user  wishes  to  understand.  In  an  ECF  analysis,  the 
chart  is  used  to  identify  the  causal  factors  associated  with  the  hardware  failure  or  human 
performance  problem. 

5.4.1  Events  and  Causal  Factors  Charting 

An  ECF  chart  is  comprised  of  symbols  that  represent  the  important  events  and  conditions  that  led 
up  to  the  hardware  failure  or  human  performance  problem  under  investigation.  An  event  in  an 
ECF  chart  is  any  action  or  occurrence  that  happened  at  a  specific  point  in  time  relative  to  the 
hardware  failure  or  human  performance  problem  under  investigation.  A  condition  is  a  state  or 
circumstance  that  affected  the  sequence  of  events  in  the  ECF  chart. 

Some  of  the  symbols  that  may  be  used  for  ECF  charting  are  as  follows2: 


A  rectangle  is  typically  used  to  indicate  an  event.  A  brief 
description  of  the  event  is  written  within  the  symbol  as  well 
as  the  date  and  time  at  which  the  event  occurred.  Events  are 
arranged  in  a  line  in  chronological  order  from  left  to  right. 

Events  that  are  assumed  to  have  occurred,  but  for  which  no 
validated  evidence  exists  or  has  yet  been  collected,  may  be 
indicated  by  a  rectangle  outlined  with  dashed  lines. 


An  oval  is  typically  used  to  indicate  a  condition.  A  brief 
description  of  the  condition  is  written  within  the  oval  and 
the  condition  is  placed  above  the  event  it  affected  on  the 
chart. 


A  condition  that  is  assumed  to  have  existed,  but  for  which 
no  validated  evidence  exists  or  has  yet  been  collected,  is 
indicated  by  an  oval  outlined  with  dashed  lines. 


A  diamond  is  used  to  indicate  the  occurrence  of  interest, 
such  as  a  significant  event. 


2  The  symbols  used  for  charting  are  unimportant.  Any  symbol  set  or  other  method  to  differentiate  among  events, 
conditions,  causes  and  their  inter-relationship,  such  as  color-coding,  may  be  used  in  the  chart. 
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Arrows  are  used  to  connect  events,  and  to  connect 
►  conditions  to  events. 


An  octagon  may  be  used  to  indicate  a  causal  factor  and  is 
placed  above  the  events  or  conditions  it  caused. 


Triangles  are  used  to  connect  event  lines  that  must  be 
broken  when,  for  example,  the  entire  sequence  of  events 
will  not  fit  on  a  page. 


An  example  of  an  ECF  chart  can  be  found  in  Figure  5- 1 .  This  example  depicts  a  partially 
completed  ECF  chart  for  an  operational  event  in  which  the  residual  heat  removed  (RHR)  system 
was  overpressurized  during  initial  pressurization  of  the  reactor  coolant  system  (RCS)  following  a 
refueling  outage  (NUREG/CR-5953,  1992). 

Events  and  causal  factors  charting  was  developed  to  support  the  investigation  of  a  single  event. 

It  can  also  be  used  to  identify  human  performance  problems.  Developing  ECF  charts  for  the 
different  errors  that  may  represent  an  adverse  trend  and  comparing  them  allows  the  detection  of 
patterns  and  similarities  in  the  events  and  conditions  associated  with  the  different  errors. 

5.4.2  Events  and  Causal  Factors  Analysis 

Analysis  of  the  ECF  chart  begins  after  the  investigation  is  completed,  although  the  analysis  itself 
may  raise  additional  questions  that  require  further  investigation.  The  analysis  is  performed  to 
identify  direct,  contributing  and  root  causes  for  the  hardware  failure  or  human  performance 
problem  of  interest.  The  analysis  consists  of  first  identifying  the  significant  events  in  the 
timeline  and  then  evaluating  them  by  asking  a  number  of  questions  about  each  one. 

An  ECF  chart  will  often  contain  events  that  did  not  play  a  causal  role  in  the  human  performance 
problem  under  investigation,  but  must  be  included  to  “tell  the  story,”  so  that  others  can 
understand  what  happened.  These  other  events  may  be  retained  in  the  chart,  but  only  the 
significant  events  will  be  analyzed. 

Identifying  the  significant  events  in  the  ECF  chart  starts  with  the  event  that  came  immediately 
before  the  hardware  failure  or  human  performance  problem  of  interest.  To  determine  whether 
this  event  is  significant  or  not,  the  question  is  asked,  “If  this  event  had  not  occurred,  would  the 
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Figure  5-1.  Partial  ECF  Chart  from  March,  1990  RHR  Overpressurization  Event 


failure  have  occurred?”  If  the  answer  to  this  question  is,  “Yes,”  then  the  question  is  asked 
whether  the  event  represented  a  normal  activity  with  the  expected  outcomes.  If  it  was  a  normal 
activity  with  the  expected  outcomes  (e.g.,  the  maintenance  technician  arrived  at  work,  control 
rods  were  inserted  and  the  reactor  scrammed),  then  it  is  not  a  significant  event  in  the  chart.  If  the 
event  had  unplanned  or  unwanted  consequences,  then  it  is  a  significant  event  in  the  chart  and 
should  be  further  analyzed  by  asking  the  following  additional  questions: 

•  What  were  the  other  events  and  conditions  that  led  to  the  significant  event? 

•  What  went  wrong  that  allowed  the  event  to  occur? 

•  Why  did  those  conditions  exist? 

•  Were  other  significant  events  necessary  for  the  failure  or  problem  to  occur  or  would  the 
recurrent  of  this  event  alone  lead  to  another  failure  or  problem? 

•  Is  the  significant  event  linked  to  other  events  or  conditions  that  may  indicate  a  more 
general  or  larger  deficiency,  such  as  a  programmatic  weakness? 

For  example,  in  Figure  5-1,  the  event  in  the  chart  that  precedes  the  overpressurization  was  the 
control  room  crew  initiating  system  pressurization.  Starting  RCS  pressurization  is  a  significant 
event  in  this  timeline,  because,  obviously,  RCS  could  not  have  overpressurized  without  it  and 
because  initiating  pressurization  had  unplanned  and  unwanted  consequences. 

The  significant  events  in  an  ECF  chart,  and  the  events  and  conditions  that  were  responsible  for 
them,  are  causal  factors.  A  brief  statement  that  summarizes  the  relevant  characteristics  of  the 
causal  factor  is  added  to  the  ECF  chart  above  the  significant  event  to  which  it  applies.  Figure  5- 
2  shows  the  ECF  chart  for  the  overpressurization  event  with  one  causal  factor  added  above  the 
conditions  and  event  in  the  chart  to  which  it  applies. 

When  each  significant  event  in  the  chart  has  been  analyzed,  relationships  among  the  causal 
factors  may  be  revealed.  For  example,  in  some  situations,  several  examples  of  training 
weaknesses  may  be  identified  or  the  failure  of  one  piece  of  equipment  or  system  is  found  to  have 
caused  several  of  the  events  in  the  chart.  When  common  causes  are  found,  they  may  indicate  the 
root  cause  of  the  problem  under  investigation. 

5.5  CHANGE  ANALYSIS 

Changes  in  the  work  environment  often  result  in  unanticipated  and  unwanted  consequences. 
Change  analysis  involves  systematically  identifying  and  analyzing  any  changes  that  may  have 
affected  the  problem  under  investigation. 

Many  types  of  changes  may  lead  to  unwanted  consequences.  These  could  include,  for  example, 
changes  in 

•  the  characteristics  or  number  of  workers  involved  in  the  task 

•  other  work  activities  going  on  concurrently  with  the  work  activity  of  interest 

•  equipment  condition  or  status 

•  the  work  location  or  the  environmental  conditions  in  which  the  work  was  performed 
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Figure  5-2.  Partial  ECF  Chart  from  March,  1990  RHR  Overpressurization  Event  with  One  Causal  Factor  Added 


supervision 

management  expectations  for  the  work. 


Changes  that  may  lead  to  an  unwanted  occurrence  can  be  difficult  to  detect  in  advance  because 
change  is  pervasive.  Change  control  processes,  such  as  reviewing  the  safety  implications  of 
planned  changes,  are  one  method  to  ensure  that  changes  do  not  have  a  negative  impact  on  safe 
operations.  Formal  reviews  or  risk  analyses  sometimes  miss  important  conditions,  however. 
There  also  are  many  avenues  for  introducing  changes  to  the  work  environment  that  do  not  appear 
to  be  sufficiently  risky  to  warrant  formal  review. 

Change  analysis  for  human  performance  problems  is  most  effective  when  the  same  work  activity 
has  been  performed  successfully  in  the  past,  when  the  work  activity  and  conditions  under  which 
it  was  performed  were  documented  or  can  be  reconstructed,  and  when  procedures  for  performing 
the  work  are  available.  Change  analysis  can  also  be  performed  by  comparing  the  work  activity 
under  investigation  to  how  the  work  activity  is  successfully  performed  at  other  sites,  or  to  “ideal” 
situations  as  documented  in  standards  and  regulations. 

The  first  step  of  a  change  analysis  is  to  define  the  “event-free  situation”  and  compare  it  to  the 
situation  in  which  the  “event”  under  investigation  occurred.  The  “event”  may  be  any  hardware 
failure,  human  error  or  human  performance  problem.  The  “event-free”  situation  is  a  comparable 
situation  in  which  the  hardware  did  not  fail  or  the  work  activity  was  performed  successfully. 

Once  the  “event”  and  “event-free”  situations  have  been  identified,  they  are  analyzed  to  determine 
the  specific  differences  between  them.  The  impact  of  each  difference  on  the  event  is  then 
evaluated  to  determine  whether  the  change  was  unimportant  or  was  a  direct,  contributing,  root 
and/or  programmatic  cause  of  the  problem. 

Table  5.1  shows  an  example  of  a  change  analysis  worksheet  for  the  overpressurization  event 
discussed  previously.  The  human  error  of  interest  is  the  operators’  failure  to  detect  and  control 
the  rapid  rise  in  RCS  pressure.  As  can  be  seen  in  Table  5.1,  four  changes  from  previous 
occasions  on  which  RCS  pressurization  activities  were  performed  successfully  were  identified. 

Evaluating  the  causal  roles  of  these  changes  involves  asking,  for  each  change,  whether  or  not  it 
meets  the  definition  of  a  direct,  contributing,  root  and/or  programmatic  cause,  or  did  not  play  a 
causal  role  in  the  error.  In  this  example,  the  inoperability  of  the  RCS  pressure  transmitters  was 
the  direct  cause  of  the  error,  because  it  was  “the  action  or  condition  immediately  preceding  the 
error  in  the  event  sequence  that  caused  or  allowed  the  error  to  occur.”  If  the  RCS  pressure 
transmitters  were  operable,  the  crew  would  have  detected  the  rapid  pressure  increase  in  time  to 
control  it  and  prevent  the  transient.  Evaluation  of  the  roles  of  the  other  four  changes,  based  on 
the  evidence  available,  indicates  that  they  were  contributing  causes.  That  is,  each  of  the  changes, 
alone,  did  not  cause  the  error,  but  rather  set  the  stage  for  it.  It  was  the  combination  of  these 
additional  changes  with  the  inoperability  of  the  RCS  pressure  indications  that  allowed  the  event 
to  occur. 
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Table  5.1  Example  Change  Analysis  Worksheet  for  an  RCS  Overpressurization  Event 


Event  Situation 

Event-Free 

Situation 

Difference 

Effect  on  Event 

RCS  pressure  instrument 
transmitters  isolated  for 
maintenance 

RCS  pressure  indicators 
operable 

No  accurate  indications 
of  RCS  pressure  were 
available 

Operators  were  unable  to 
monitor  RCS  pressure 

Fill  and  venting  of  reactor 
head  extended 

Fill  and  vent  evolution 
completed  within  normal 
time  limits 

Venting  continued  1-2 
hours  longer  than 
normally 

The  longer  vent  and  fill 
evolution  decreased  the 
volume  of  gases  in  the  steam 
generator  (SG)  U  tubes 

Reduced  volume  of  gases 
in  SG  U  tubes  caused  by 
longer  vent  time 

Greater  volume  of  gases 
in  SG  U  tubes 

Reduced  amount  of  non¬ 
condensable  gases 
caused  RCS  pressure  to 
increase  sooner  than  in 
previous  refill  operations 

RCS  pressure  rose  sooner 
then  expected  and 
approached  100  psig  within 
2.5  hours  of  initiating 
pressurization 

Operators  were 
monitoring  the  inoperable 
RCS  pressure  gauges,  but 
not  all  available  pressure 
indications  (e.g.,  letdown 
and  RHR  discharge  pump 
pressure  gauges) 

Operators  monitored  all 
available  pressure 
indications 

Operators  did  not  detect 
indications  of  the  rapid 
pressure  increases  on  the 
letdown  and  RHR 
discharge  pump  pressure 
gauges 

An  opportunity  to  detect  the 
pressure  rise  and  prevent  the 
overpressurization  was 
missed 

5.6  BARRIER  ANALYSIS 

The  barrier  analysis  technique  can  also  be  used  to  identify  causes  for  human  performance 
problems.  The  purpose  of  a  barrier  analysis  is  to  identify  the  barriers  to  error  that  were  missing, 
bypassed  or  failed  and  their  causal  roles.  Barrier  analysis  also  shows  the  barriers  that  succeeded 
and  prevented  the  problem  from  having  more  serious  consequences. 

Barrier  analysis  is  based  on  the  concept  that  hazards  represent  potentially  harmful  energy  flows 
or  environmental  conditions  from  which  targets  (i.e.,  personnel  and  equipment)  must  be 
protected.  Hazards  to  personnel  may  include,  for  example,  radiation,  electrical  energy,  chemical 
and  biological  agents  or  adverse  environmental  conditions.  Hazards  to  equipment  may  include 
human  error,  damage  from  wear  and  tear  or  natural  phenomena. 

A  barrier  is  any  means  used  to  protect  targets  from  hazards.  There  are  two  basic  types: 
physical  and  management  barriers.  Examples  of  typical  physical  barriers  used  in  industrial 
settings  to  protect  personnel  are  fences,  guardrails  around  moving  equipment,  protective  clothing 
and  safety  devices.  Management  barriers  used  to  protect  equipment  in  nuclear  licensee  facilities 
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include  preventative  and  corrective  maintenance  as  well  as  supervision,  training,  the  design  of 
the  human-system  interface  or  procedures  to  reduce  the  likelihood  of  damage  from  human  error. 
The  barriers  that  could  or  should  have  been  in-place  and  how  they  should  have  functioned  can  be 
identified  from  subject  matter  expertise,  knowledge  of  industry  good  practices,  licensee  policies 
and  procedures,  design  basis  documents  and  regulations. 

A  barrier  analysis  is  performed  in  five  steps.  The  first  step  is  to  identify  the  hazard  and  target. 
The  second  step  is  to  identify  all  of  the  barriers  that  could  have  protected  the  target  from  the 
hazard.  The  third  step  is  to  evaluate  how  each  barrier  performed.  That  is,  did  the  barrier  succeed 
or  fail?  For  barriers  that  failed,  the  fourth  step  is  to  determine  why  they  failed.  Finally,  the 
causal  role  of  each  barrier  is  evaluated  to  determine  whether  it  was  a  direct,  contributing,  root 
and/or  programmatic  cause. 

This  technique  is  particularly  useful  in  providing  the  basis  for  developing  corrective  actions  to 
prevent  the  same  or  a  similar  problem  from  happening  again.  Corrective  actions  can  strengthen 
existing  barriers  that  failed  or  erect  barriers  where  they  are  missing. 

Table  5.2  shows  an  example  of  a  barrier  analysis  worksheet  for  the  RCS  overpressurization 
event.  In  this  example,  the  hazard  would  be  pressure  and  the  target  would  be  the  catastrophic 
failure  of  the  reactor  coolant  or  residual  heat  removal  system  piping. 

Evaluating  the  causal  role  of  each  failed  barrier  involves  asking  whether  or  not  it  meets  the 
definition  of  a  direct,  contributing  or  root  cause,  or  did  not  play  a  causal  role  in  the  error.  In  this 
example,  the  inoperability  of  the  RCS  pressure  transmitters  again  meets  the  criterion  for  the 
direct  cause  of  the  error,  because  it  was  “the  action  or  condition  immediately  preceding  the  error 
in  the  event  sequence  that  caused  or  allowed  the  error  to  occur.”  Further,  if  the  RCS  pressure 
transmitters  were  operable,  two  additional  physical  barriers  would  not  have  failed:  the  power- 
operated  relief  valves  (PORVs)  low-temperature  overpressure  protection  and  the  computer 
alarm.  Because  the  failure  of  these  barriers  was  dependent  upon  the  RCS  pressure  transmitters 
being  inoperable,  they  are  contributing  causes  of  this  event. 

As  can  be  seen  from  this  example,  barrier  analysis  is  an  effective  method  to  begin  identifying 
programmatic  causes  as  well  as  potential  corrective  actions.  For  example,  had  the  RCS  pressure 
indicators  been  tagged  out-of-service,  it  is  unlikely  that  the  operators  would  have  started  RCS 
pressurization  activities  until  these  indications  were  available.  The  station’s  policy  of  excluding 
control  room  instrumentation  from  the  tagout  program  indicates  that  the  scope  of  the  tagout 
program  may  have  been  a  programmatic  weakness  that,  if  corrected,  could  have  prevented  this 
event  and  other,  similar  events.  However,  responsibility  for  configuration  control  lies  with  the 
work  management  program.  Had  the  work  planners  (or  an  independent  review)  recognized  that 
the  RCS  indicators  were  not  available  for  initial  RCS  pressurization  and  ensured  that  they  were, 
the  rate  of  the  pressure  rise  and  the  operators’  focus  on  the  three  RCS  indicators  would  not  have 
mattered  because  accurate  pressure  indications  would  have  been  available  to  detect  and  control 
pressure.  Therefore,  the  startup  procedure  and  the  operators’  status  monitoring  were  contributing 
causes  to  the  event,  but  not  root  causes.  Further  investigation  of  the  work  management  program 
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Table  5.2  Example  Barrier  Analysis  Worksheet  for  Overpressurization  Event 


Hazard:  Pressure 

Target:  Catastrophic  failure  of  system  piping 

Physical  Barriers 

Performance 

Why  Did  it  Fail? 

Effect  on  Event 

RCS  pressure  instrument 
transmitters 

Failed 

Out  of  service  for 
maintenance 

RCS  pressure  indicators 
inoperable  so  operators  could 
not  detect  rapid  pressure  rise 

Power-operated  relief 
valves  (PORVs)  low- 
temperature  overpressure 
protection 

Failed 

The  two  wide-range  RCS 
pressure  instruments  were 
the  sensors  for  the  PORV 
low- temperature  over¬ 
pressure  protection  mode 

PORV  low-temperature  over¬ 
pressure  protection 
unavailable 

RHR  Pump  B  suction 
relief  valve 

Succeeded  in  stopping 
uncontrolled  pressure 
rise 

Maintained  pressure  below 
limits  -  prevented 
catastrophic  failure  of  RHR 
piping 

Pressurizer  relief  tank 
(PRT)  level  indication 

PRT  level  increased 
when  RHR  suction 
relief  valve  opened 

Succeeded  in  alerting 
operators  to  problem  situation 

Annunciators 

Missing 

RHR  pressure  did  not  reach 
alarm  actuation  setpoint  and 
computer  alarm  came  off  the 
inoperable  pressure 
transmitters 

No  audible  indications  of 
pressure  rise 

Management 

Barriers 

Performance 

Why  Did  it  Fail? 

Effect  on  Event 

Startup  procedures 

Did  not  control  RCS 
vent  evolution 

Fill  and  vent  procedure  did 
not  specify  a  time  limit  for 
venting  gases  from  reactor 
head 

Night  shift  extended  the  RCS 
vent  evolution  1-2  hours 
longer  than  normal,  reducing 
the  volume  of  gases  remaining 
in  the  SG  U  tubes 

Work  management 
(planning  and 
scheduling) 

Failed 

Work  planners  overlooked 
the  need  for  the  RCS 
pressure  instruments  to  be 
operable  before  initial 
pressurization  of  the  RCS 

Pressurization  was  initiated 
without  RCS  pressure 
indications  operable 

Independent  review 

Missing 

Not  performed  or  required 

Failed  to  identify  the  RCS 
pressure  instrument  isolation 

Tagging  out-of-service 
control  room  instruments 

Missing 

Tagging  of  out-of-service 
instruments  in  control  room 
not  required  by  tagout 
program 

There  was  no  visual  cue  that 
the  three  RCS  pressure 
indicators  were  inoperable 

Systems  monitoring 

Inadequate 

Operators  were  focused  on 
the  RCS  pressure  indicators 
and  were  not  monitoring  all 
pressure  indications 
available 

Operators  did  not  notice  other 
indications  of  the  pressure  rise 
that  indicated  RHR,  CVCS 
and  RCS  were  pressurized 

5-12 


would  be  necessary  to  identify  the  specific  weaknesses  that  allowed  this  event  to  occur,  as  well 
as  the  corrective  actions  necessary  to  strengthen  the  program.  However,  flaws  in  the  work 
management  program  appear  to  have  been  the  root  cause  of  the  operators’  error  in  this  event. 

5.7  COMBINING  TECHNIQUES 

Practical  experience  has  shown  that  different  root  cause  analysis  techniques  provide  different 
perspectives  on  an  event.  As  a  result,  using  a  combination  of  methods  ensures  that  a  more 
complete  set  of  causal  factors  is  identified. 

Because  different  root  cause  analysis  techniques  ask  different  questions  about  a  human 
performance  or  hardware  problem,  the  causes  that  are  identified  may  differ.  Compare,  for 
example,  the  differences  in  the  causal  factors  above  that  resulted  from  the  change  and  barrier 
analyses  for  the  overpressurization  event.  For  the  overpressurization  event,  the  barrier  analysis 
yielded  a  larger  number  of  causal  factors  and  led  to  the  identification  of  the  root  causes  of  the 
event.  For  other  events,  changes  may  be  the  key  causal  factors  and  barrier  analysis  used  alone 
may  not  identify  them. 

No  matter  which  root  cause  analysis  techniques  are  used  by  a  licensee,  the  purpose  of  the 
analysis  is  to  identify  the  causal  factors  that,  if  corrected,  would  minimize  the  likelihood  that  the 
same  and  similar  “significant  conditions  adverse  to  quality”  will  occur  again.  The  effectiveness 
of  a  problem  identification  and  resolution  program  rests  less  on  the  root  cause  analysis 
techniques  used  than  on  the  thoroughness  of  the  investigation  conducted,  assurance  that  the  key 
causal  factors  have  been  identified,  and  the  development  and  implementation  of  the  corrective 
actions  suggested  by  the  analysis. 
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6  EVALUATING  CORRECTIVE  ACTION  PLANS 


6.1  INTRODUCTION 

An  effective  corrective  action  for  a  human  performance  problem  is  one  that  will  minimize  the 
likelihood  of  the  problem  happening  again.  Developing  effective  corrective  actions  for  human 
performance  problems  requires  a  thorough  root  cause  analysis  and  an  understanding  of  methods 
for  enhancing  human  performance. 

In  this  section,  background  information  for  evaluating  corrective  actions  plans  is  presented.  The 
different  types  of  corrective  action  plans  and  issues  in  implementing  them  are  discussed. 

6.2  CORRECTIVE  ACTION  PLAN  SCOPE 

Corrective  action  plans,  which  incorporate  corrective  actions  for  human  performance  problems, 
vary  in  scope.  The  scope  of  the  plan  is  determined  by  the  significance  of  the  error  or  adverse 
trend  as  well  as  the  extent  of  the  conditions  created  by  the  causal  factors  identified.  Three  types 
are  described  below. 

The  broadest  type  is  a  general  organizational  improvement  plan.  This  type  of  plan  usually 
involves  all  or  a  large  number  of  the  work  groups  at  a  site  and,  sometimes,  corporate 
headquarters.  Its  purpose  is  to  make  significant  changes  in  how  work  is  done  and  how  it  is 
managed  in  order  to  improve  operational  performance  and  to  reverse  declining  performance 
trends.  Corrective  actions  may  address  problems  in  any  aspect  of  plant  operations,  such  as 

•  changing  the  organizational  structure 

•  changing  managers’  spans  of  control 

•  improving  manager  capabilities  and  competence 

•  improving  worker  training  and  qualification  programs 

•  revising  the  hierarchical  family  of  vision,  goals,  objectives,  policies,  programs,  processes, 
procedures  and  practices. 

General  organizational  improvement  plans  are  typically  required  to  correct  a  safety  culture 
problem  in  an  organization. 

An  intermediate  scope  corrective  action  plan  focuses  on  adding  to  or  strengthening  the 
programs  that  are  responsible  for  maintaining  barriers  to  human  performance  problems.  Typical 
programs  that  are  implemented  to  maintain  barriers  to  error  are: 

•  programs  for  developing  procedures,  keeping  them  updated  and  requiring  their  use  for 
certain  jobs 

•  human  resources  programs  for  selecting  and  promoting  personnel 

•  behavioral  safety  programs  such  as  STAR  (Stop,  Think,  Act,  Review) 
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•  human-system  interface  design  programs,  such  as  the  program  responsible  for  ensuring 
that  labels  on  parts  and  equipment  are  accurate  and  legible 

•  management  systems  for  defining  and  organizing  work  flow 

•  quality  control  programs. 

Limited  scope  corrective  action  plans  focus  on  fixing  the  direct  cause  of  an  error.  These  plans 
add  or  strengthen  specific  barriers. 

Corrective  actions  to  add  new  barriers  might  include: 

•  writing  a  procedure  for  a  task  that  previously  depended  on  “skill  of  the  craft” 

•  moving  personnel  with  operations  experience  into  the  work  planning  group 

•  developing  a  new  training  module  for  maintenance  workers,  or 

•  replacing  an  analog  display  with  a  new  digital  display  that  is  more  accurate  and  easier  to 
read. 

Corrective  actions  to  strengthen  existing  barriers  could  be  redesigning  an  existing  training 
module  or  adding  a  requirement  for  a  supervisor  to  be  present  when  a  particular  job  is 
performed.  Most  limited  corrective  action  plans  use  a  combination  of  adding  new  and 
strengthening  existing  barriers. 

Sometimes  correcting  the  direct  cause  of  an  error  will  prevent  that  specific  error  from  recurring 
but  fail  to  prevent  similar  errors.  For  example,  if  the  direct  cause  of  an  error  was  an  ambiguous 
procedure  step,  fixing  that  one  step  may  stop  others  from  making  the  same  error  when 
performing  that  step.  But  fixing  that  step  in  the  procedure  will  not  correct  other  ambiguous  steps 
in  the  same  procedure  or  in  other  procedures.  If  the  ambiguous  steps  have  the  same  root  cause, 
such  as  a  procedure  writer  in  need  of  additional  training,  the  root  cause  must  be  corrected  to 
prevent  future  errors  due  to  poorly  written  procedure  steps. 

Corrective  action  plans  must  also  address  any  adverse  conditions  that  were  created  by  a  human 
performance  problem,  based  upon  the  assessment  done  of  the  extent  of  the  conditions  created  by 
a  causal  factor.  For  example,  if  an  instrument  is  miscalibrated  and  the  cause  is  determined  to  be 
an  error  in  a  miscalibration  procedure,  the  corrective  action  plan  must  include  actions  not  only  to 
ensure  that  the  instrument  is  re-calibrated  correctly,  but  also  that  other  instruments  governed  by 
the  same  procedure  are  also  calibrated  correctly. 

The  appropriate  scope  of  a  corrective  action  plan  depends  upon  the  nature  of  the  causal  factors 
identified  in  the  root  cause  analysis,  their  scope  and  the  risks  they  pose.  Licensees  may  use 
probabilistic  risk  assessment  or  human  reliability  analysis  methods  to  choose  among  corrective 
action  alternatives. 
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6.3  ACCOUNTABILITY  FOR  HUMAN  PERFORMANCE 


Some  corrective  actions  in  a  corrective  action  plan  may  focus  on  the  individual  worker  who 
committed  an  error.  These  corrective  actions  may  include,  for  example,  remedial  training, 
participation  in  the  investigation  and  root  cause  analysis,  loss  of  qualification  for  a  period  of  time 
and/or  time  off  work. 

Corrective  actions  that  focus  on  the  individual  worker  are  often  ineffective.  Routinely  placing 
responsibility  for  errors  on  the  individual  workers  adversely  impacts  a  licensee’s  safety  culture 
and  may  discourage  personnel  from  reporting  errors  or  raising  concerns.  A  “blame  the  worker” 
approach  to  human  performance  may  result  in  adversarial  relations  between  workers  and 
supervisors,  which  will  hinder  effective  communication  and  teamwork.  On  the  other  hand,  it 
may  be  appropriate  to  hold  workers  accountable  for  errors  if  they  have  been  provided  with  the 
necessary  resources  to  perform  their  tasks  correctly.  These  resources  include  relevant  training, 
usable  and  technically  accurate  procedures,  well-designed  tools  and  equipment,  accurate 
drawings,  labels  on  equipment  and  other  operator  aids,  and  clearly  defined  and  specific 
management  expectations  for  performing  each  task.  Industry  experience  has  shown  that 
improving  human  performance  requires  balancing  the  organization’s  responsibility  for  providing 
personnel  with  the  tools  and  resources  they  need  to  accomplish  their  tasks  with  individual 
accountability  for  performance  to  reasonable  standards. 

6.4  CORRECTIVE  ACTION  PLAN  COMPLETENESS 

An  important  requirement  for  corrective  action  plan  effectiveness  is  completeness.  A  complete 
corrective  action  plan  addresses  each  of  the  causal  factors  that  were  identified  from  the  root 
cause  analysis.  In  some  cases,  a  single  corrective  action  may  address  more  than  one  causal 
factor.  For  example,  if  a  root  cause  analysis  has  identified  several  weaknesses  in  work  planning 
and  scheduling,  the  licensee  may  decide  to  re-engineer  the  entire  work  management  program. 
Often,  several  corrective  actions  may  be  developed  to  address  one  causal  factor.  More  than  one 
corrective  action  may  be  required  because  the  causal  factor  is  complex  or  the  licensee  wishes  to 
ensure  there  is  “defense-in-depth”  against  a  recurrence  of  the  human  performance  problem. 

6.5  PLAN  IMPLEMENTATION  AND  EFFECTIVENESS 

Corrective  action  plans  that  appear  to  have  an  appropriate  scope  and  to  be  complete  may  be 
ineffective  when  they  are  implemented.  Corrective  action  plan  implementation  may  be 
ineffective  for  several  reasons. 

A  common  reason  that  corrective  action  plans  fail  is  that  detailed  information  from  the  problem 
investigation  and  root  cause  analysis  is  not  communicated  to  those  who  are  assigned 
responsibility  for  developing  and  implementing  the  corrective  actions.  The  detailed  information 
about  the  human  performance  problem  that  has  been  collected  is  usually  not  recorded  in  the 
investigation  report  or  presented  in  a  briefing.  Further,  information  collected  about  human 
performance  problem  may  include  sensitive  personnel  matters  that  are  not  documented.  A 
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detailed  understanding  of  the  human  performance  problem  is  necessary  for  corrective  action 
effectiveness,  however,  because  these  problems  are  typically  complex  with  multiple,  interacting 
causes.  Ensuring  that  the  individuals  involved  in  investigating  and  analyzing  human 
performance  problems  work  closely  with  the  personnel  responsible  for  the  corrective  action 
plans  improves  the  likelihood  that  the  plans  will  be  effective. 

Other  commonly  identified  reasons  for  ineffective  corrective  action  plans  are: 

•  Responsibility  not  assigned.  Responsibility  for  developing,  implementing  and 
monitoring  the  effectiveness  of  corrective  actions  may  not  be  assigned  to  specific 
individuals  who  are  held  accountable  for  them.  Responsibility  for  corrective  actions 
may  be  assigned  to  a  department  or  to  “management,”  rather  than  to  individuals  who 
have  the  expertise,  authority  and  resources  to  ensure  they  are  implemented. 

•  Staffing  changes.  Personnel  change  jobs  and  the  individuals  who  developed  and 
began  implementing  a  corrective  action  plan  may  move  on  to  other  positions.  The 
information  they  had  about  the  basis  for  a  corrective  action  plan  may  not  be 
communicated  to  their  successors. 

•  The  steps  for  achieving  the  plan’s  objectives  are  not  defined.  Some  corrective 
action  plans  define  the  goals  to  be  achieved,  but  not  the  steps  required  to  achieve 
them.  Corrective  action  implementation  is  typically  most  effective  when  project 
management  techniques  are  used,  such  as  defining  milestones  and  deliverables,  a 
project  schedule,  the  resources  required,  and  so  on. 

•  Competition  for  resources.  Other  management  initiatives  and  events  arise  that  take 
precedence  over  implementing  the  corrective  actions. 

•  Measurement.  Corrective  action  plans  may  fail  because  measures  for  determining 
the  success  of  the  corrective  actions  were  not  defined  and  used  to  refine  the  plan 
when  necessary. 

•  Unintended  consequences.  Corrective  actions  may  have  unforeseen,  unintended 
consequences  that  cause  them  to  fail. 

For  human  performance  problems  that  have  a  relatively  high  risk  significance,  the  licensee  may 
schedule  effectiveness  reviews  for  the  corrective  action  plan  that  was  implemented.  Corrective 
action  effectiveness  reviews  are  analyses  of  whether  the  corrective  actions  in  a  plan  have 
worked  as  intended.  They  are  typically  scheduled  weeks  or  months  after  a  corrective  action  has 
been  implemented  and  has  had  time  to  demonstrate  an  effect.  The  schedule  for  conducting 
effectiveness  reviews  and  the  measures  of  effectiveness  that  will  be  used  may  be  included  in  the 
initial  corrective  action  plan. 
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6.6  CONCLUSION 


The  most  important  test  of  a  corrective  action  plan  is  whether  it  succeeds  in  minimizing 
recurrence  of  the  human  performance  problem  it  is  designed  to  address.  As  discussed  in  Section 
3,  however,  the  recurrence  of  a  problem  behavior  does  not  necessarily  indicate  that  a  corrective 
action  plan  is  ineffective  because  the  same  behavior  can  result  from  many  different  causal 
factors.  The  corrective  action  plan  may  have  been  effective  in  controlling  one  cause  for  a 
particular  behavior,  but  other  causes  may  still  exist.  These  other  causes  could  not  have  been 
identified  in  the  investigation  and  analysis  because  they  did  not  play  a  role  in  the  original 
problem.  Investigation  and  causal  analysis  of  the  recurrent  problem  behavior  would  be 
necessary  to  determine  whether  the  corrective  action  plan  for  the  initial  problem  was  ineffective 
or  whether  the  recurrent  problem  is  due  to  other  causes  that  would  then  need  to  be  addressed. 
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THE  HUMAN  PERFORMANCE  EVALUATION  PROCESS 


Part  II:  The  HPEP  Cause  Tree  and  Modules 
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7  OVERVIEW  OF  THE  HPEP  CAUSE  TREE  AND  MODULES 


7.1  INTRODUCTION 

Part  II  of  the  Human  Performance  Evaluation  Process  (HPEP)  is  comprised  of  the  HPEP  Cause 
Tree  and  Modules.  The  HPEP  Cause  Tree  is  a  screening  tool  for  identifying  the  range  of 
possible  causes  for  a  human  performance  problem.  The  Cause  Modules  discuss  typical  causes  of 
human  performance  problems  in  nuclear  licensee  facilities  and  provide  examples  of  frequently 
identified  direct  and  programmatic  causes,  based  upon  the  research  literature  and  industry 
experience. 

The  Cause  Tree  and  Modules  are  not  a  complete  list  of  all  possible  causes  for  human  errors.  In 
practice,  the  evidence  that  is  collected  in  an  investigation  and  the  results  of  causal  analyses  are 
necessary  to  determine  an  error’s  actual  cause(s).  The  primary  value  of  a  list  of  possible  causes, 
such  as  those  presented  here,  is  that  it  prompts  consideration  of  a  range  of  causes.  Used  as  a 
checklist,  the  Cause  Tree  and  Modules  assist  in  overcoming  the  tendency  to  arrive  at  conclusions 
too  early  in  an  investigation  or  to  only  investigate  the  possibilities  that  are  initially  suggested 
when  an  error  is  committed.  Thus,  the  Cause  Tree  and  Modules  are  intended  to  be  used 
heuristically,  but  the  possible  causes  that  are  investigated  must  be  derived  from  the  evidence. 

7.2  USING  THE  CAUSE  TREE  AND  MODULES 

Part  II  is  for  use  by  inspectors  to  verify  the  causes  that  a  licensee  has  identified  for  human 
performance  problems  in  order  to  complete  Table  2.3,  Causal  Analyses,  in  Part  I.  The  HPEP 
Cause  Tree  and  Cause  Modules  may  also  be  used  as  guidance  in  conducting  an  event 
investigation  and  to  identify  a  human  performance  trend. 

7.2.1  Verification 

The  HPEP  Cause  Tree  and  Modules  are  intended  to  assist  in  evaluating  a  licensee’s  causal 
analyses  of  human  performance  problems.  In  general,  a  causal  analysis  that  is  complete  and 
valid  will  also  be  reliable.  That  is,  it  will  yield  similar  results  when  repeated  by  another 
individual  or  team,  although  the  specific  terminology  used  to  describe  the  cause(s)  will  likely 
differ.  By  answering  the  questions  in  the  Cause  Tree  and  reviewing  the  information  in  the 
appropriate  Cause  Modules,  the  inspector  could  verify  that  the  evidence  the  licensee  has  gathered 
supports  the  causes  identified  and  that  other  plausible  causes  can  be  ruled  out. 

To  verify  the  licensee’s  conclusions,  the  inspector  may  (1)  use  the  information  available  in  the 
licensee’s  documentation  of  the  investigation  or  collect  evidence  independently,  (2)  answer  the 
questions  in  the  Cause  Tree  and  then  (3)  review  the  information  in  the  appropriate  Cause 
Modules  to  determine  whether  or  not  the  licensee  correctly  identified  the  causes  of  a  human 
performance  problem.  If  the  inspector  arrives  at  direct  and  programmatic  causes  that  are  similar 
to  those  documented  by  the  licensee,  based  upon  the  same  evidence,  it  is  likely  that  the  licensee 
has  accurately  identified  the  causes  for  the  human  performance  problem.  If  the  inspector  arrives 
at  different  direct  and  programmatic  causes,  then  the  Cause  Modules  may  be  used  to  identify 
additional  information  to  request  from  the  licensee.  Or,  the  inspector  may  use  the  Cause 
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Modules  to  determine  the  lines  of  inquiry  for  an  independent  investigation.  In  most  cases, 
discrepancies  between  the  inspectors’  cause(s)  and  the  licensee’s  will  be  resolved  on  the  basis  of 
the  evidence. 

7.2.2  Conducting  an  Independent  Event  Investigation 

If  an  inspector  or  NRC  inspection  team  is  conducting  an  independent  event  investigation,  the 
Cause  Tree  and  Modules  can  be  used  to  understand  the  human  errors  that  occurred  in  the  event. 
The  Cause  Tree  and  Modules  may  be  used  to  identify  promising  lines  of  inquiry  to  explore  in  the 
investigation.  They  may  also  serve  as  a  checklist  to  ensure  that  possible  causes  for  the  error(s) 
have  not  been  overlooked. 

The  Cause  Tree  will  streamline  an  investigation  by  directing  inspectors  to  the  most  likely  causes 
of  an  error.  Further  evidence  can  then  be  collected  regarding  a  specific  cause  to  support  the 
causal  analysis.  The  lists  of  possible  direct  and  programmatic  causes  within  the  Modules  may  be 
used  to  develop  the  specific  lines  of  inquiry.  For  example,  the  Cause  Tree  would  prompt 
inspectors  to  ask,  “Were  there  weaknesses  in  the  procedures  used  to  perform  the  task?”  If  the 
answer  were  “yes,”  then  the  Procedures  Module  in  Section  1 1  would  prompt  the  investigators  to 
further  ask,  “What  were  the  procedural  weaknesses  and  did  they  cause  or  contribute  to  the  error? 
Were  there  systematic  weaknesses  in  the  procedures  or  another  program  that  allowed  these  flaws 
in  the  procedure  to  exist?  Are  other  licensee  procedures  similarly  affected?” 

As  the  investigation  matures,  the  Cause  Tree  and  Modules  can  be  reviewed  again  to  verify  that 
potential  causes  have  not  been  overlooked.  Often  the  evidence  that  is  gathered  indicates  that 
different  causes  than  originally  identified  should  be  investigated.  Repeated  reference  to  the 
Cause  Tree  and  Modules  during  the  course  of  an  investigation  may  help  to  assure  that  the 
investigation  is  complete  and  that  sufficient  evidence  has  been  gathered  to  support  the  team’s 
conclusions. 

7.2.3  Identifying  a  Human  Performance  Trend 

The  Cause  Tree  and  Modules  may  also  be  helpful  in  identifying  a  human  performance  trend.  A 
human  performance  trend  may  be  indicated  if  one  cause  category,  such  a  procedures  or 
supervision,  is  repeatedly  identified  by  the  licensee  in  a  sample  of  problem  reports,  or  appears  to 
the  inspector  to  be  implicated  in  numerous  problem  reports. 

To  verify  that  a  human  performance  trend  has  developed,  however,  it  is  important  that  the  human 
errors  are  investigated  and  analyzed  sufficiently  to  identify  the  direct  and  programmatic  causes 
with  some  confidence.  By  definition,  a  human  performance  trend  is  a  pattern  of  related  errors 
resulting  from  the  same  causal  factor.  Therefore,  licensee  reports  of  the  apparent  causes  of  an 
error  may  be  suggestive,  but  even  a  large  number  of  reports  citing  a  particular  cause  category  do 
not  establish  the  existence  of  a  human  performance  trend  unless  the  direct  and  programmatic 
causes  of  the  errors  are  known. 
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7.3  ORGANIZATION 


The  HPEP  Cause  Tree  is  presented  in  Figure  7-1.  The  HPEP  Cause  Modules  are  presented  in 
Sections  8  through  18.  The  Cause  Tree  asks  a  series  of  questions  about  the  conditions 
surrounding  a  human  error  of  interest.  Based  upon  the  answers  to  those  questions,  the  inspector 
is  referred  to  the  appropriate  Cause  Modules.  Each  Cause  Module  is  comprised  of  causal  factors 
that  have  been  found  to  affect  human  performance  in  the  workplace  as  follows: 

Personnel  -  These  Cause  Modules  discuss  characteristics  that  individual  workers  bring  to  the 
job  that  may  affect  task  performance,  such  as 

Section  8:  Fitness  for  Duty 

Section  9:  Knowledge,  Skills  and  Abilities 

Section  10:  Attention  and  Motivation 


Resources  -  These  Cause  Modules  discuss  characteristics  of  the  resources  available  to  personnel 
to  assist  in  performing  their  tasks,  such  as 


Section  1 1 : 
Section  12: 
Section  13: 
Section  14: 


Procedures  and  Reference  Documentation 

Tools  and  Equipment 

Staffing 

Supervision 


Work  Environment  -  These  Cause  Modules  discuss  characteristics  of  the  work  environments  in 
which  personnel  perform  tasks,  such  as 

Section  15:  Human-System  Interface 

Section  16:  Task  Environment 


Communication  and  Coordination  -  These  Cause  Modules  discuss  characteristics  of  the 
human  interactions  required  to  perform  a  task  correctly,  such  as 

Section  17:  Communication 

Section  18:  Coordination  and  Control 


Within  each  Cause  Module,  background  information  is  presented  regarding  the  effects  of  each 
causal  factor  on  human  performance  and  examples  of  typical  direct  and  programmatic  causes  for 
errors  are  listed. 
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8  FITNESS  FOR  DUTY 


8.1  ERRORS  RELATED  TO  FITNESS  FOR  DUTY 

Successful  task  performance  requires  that  the  capabilities  workers  bring  to  the  task  fall  within  an 
expected  range.  Impairment,  or  a  reduction  in  an  individual’s  mental  or  physical  capabilities 
due  to  substance  abuse,  fatigue,  illness  or  stress,  increases  the  likelihood  of  errors.  Types  of 
possible  impairments  and  their  likely  consequences  for  task  performance  are  discussed  below. 

8.1.1  Drug  and  Alcohol  Use 

The  use  of  some  drugs  and  alcohol  on  the  job  or  within  several  hours  of  reporting  to  work  may 
adversely  impact  human  performance.  Extensive  information  about  the  effects  of  different  drugs 
on  task  performance,  including  prescription  and  over-the-counter  (OTC)  drugs,  has  been 
published  elsewhere  (see  Section  8.4  of  this  Module  below).  This  information  is  briefly 
summarized  here. 

8.1. 1.1  Marijuana 

The  use  of  marijuana  has  several  effects  that  may  adversely  impact  task  performance.  Marijuana 
use  decreases  the  ability  to  process  both  auditory  and  visual  stimuli,  so  may  affect,  for  example, 
an  individual’s  ability  to  read  and  follow  procedures  correctly  or  to  correctly  process  verbal 
instructions.  It  also  reduces  an  individual’s  attention  span.  Other  effects  include  impaired  social 
behavior  and  reduced  retention  and  recall  of  information.  Marijuana  use  also  affects  motor 
performance.  It  slows  reaction  time,  decreases  motor  steadiness  and  manual  dexterity,  and 
reduces  eye-hand  coordination. 

8.1. 1.2  Stimulants 

Drugs  that  are  stimulants  include  caffeine,  cocaine  and  amphetamines.  Some  OTC  medications 
also  contain  stimulants,  such  as  pseudophedrine,  which  is  commonly  used  in  cold  and  allergy 
medications.  In  small  amounts,  stimulants  generally  improve  both  cognitive  and  motor 
performance.  For  example,  attention  span  is  increased,  vigilance  is  improved  and  reaction  time 
is  faster.  Larger  doses  or  chronic  use  adversely  affect  performance  in  all  areas. 

8. 1.1.3  Depressants 

Central  nervous  system  depressants  include  the  opiates,  barbiturates,  sedatives,  the  minor 
tranquilizers  and  alcohol.  In  general,  higher  doses  are  associated  with  significant  cognitive  and 
motor  performance  impairments.  At  lower  doses,  the  effects  depend  upon  the  specific  drug  used, 
body  weight  and  the  extent  to  which  the  user  has  become  habituated  to  it.  For  example,  eye- 
hand  coordination  and  performance  of  complex  tasks  will  be  adversely  affected  by  barbiturate 
use,  but  typically  are  not  affected  by  the  minor  tranquilizers.  Use  of  drugs  in  this  class  will  often 
cause  drowsiness  when  they  are  first  taken,  but  this  effect  decreases  with  continued  use. 
Depressants  cause  disruptions  in  auditory  and  visual  information  processing,  impair  learning  and 
recall,  and  reduce  attention  span. 
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8.1. 1.4  Hallucinogens 

Hallucinogens,  by  definition,  are  drugs  that  distort  sensory  perception,  thought  processes  and 
behavior.  There  are  four  subclasses:  anticholinergics  (these  are  rare),  catechols  (e.g.,  peyote, 
mescaline,  MDA),  indoles  (e.g.,  LSD,  psilocybin),  and  anaesthetics  (e.g.,  PCP).  The 
anticholinergics  are  highly  toxic  and  not  of  concern  in  the  workplace.  The  catechols  distort 
perception  of  light,  color,  space  and  shapes,  and  increase  alertness.  They  are  not  associated  with 
memory  loss,  but  may  cause  muscle  spasms  in  large  doses.  The  indoles  primarily  cause  mood 
and  sensory  perception  changes  leading  to  altered  senses  of  time,  space,  touch  and  color.  Vision 
and  hearing  are  impaired  and  motor  functions  decline.  At  higher  doses  of  indoles,  the  user  may 
experience  euphoria,  fear,  hostility  and  confusion.  Anaesthetics  cause  confusion,  distorted 
spatial  awareness,  aggression,  trouble  breathing  and  numbed  nerves. 

8.1.2  Fatigue 

Fatigue  has  been  shown  to  impair  both  cognitive  and  motor  performance  with  an  important 
adverse  effect  on  alertness.  Fatigue  decreases  the  ability  to  process  complex  information  such  as 
that  presented  by  unusual  plant  conditions.  In  addition,  fatigue  may  increase  reaction  time,  and 
impair  recall  and  decision-making.  As  fatigue  increases,  performance  is  increasingly  impaired 
and  shows  greater  variability. 

There  are  many  factors  that  may  cause  fatigue.  These  include  the  amount  of  time  spent  working 
on  a  single  task,  sleep  disorders  and  deprivation,  and  the  effects  of  circadian  rhythms  or  their 
disruption.  For  example,  long  periods  of  time  performing  a  single  physical  task  will  cause 
muscles  to  become  fatigued  so  that  they  are  less  easily  controlled  and  errors  are  more  likely. 

Sleep  disorders  and  sleep  schedules  that  do  not  allow  sufficient  deep  sleep  will  adversely  affect 
cognitive  and  motor  performance  and,  over  time,  individuals  will  accumulate  a  “sleep  debt.” 

That  is,  most  working-age  adults  require  about  eight  hours  of  sleep  on  a  regular  schedule  to 
maintain  optimum  alertness,  mood  and  performance  levels.  If  sleep  is  ineffective  or  insufficient, 
impairments  will  be  seen  during  the  next  waking  period.  If  sleep  is  ineffective  or  insufficient  for 
an  extended  period,  the  impairments  will  be  cumulative. 

Task  performance  and  alertness  are  also  affected  by  circadian  rhythms.  Circadian  rhythms  are 
also  known  as  “biological  clocks”  and  are  patterns  in  physiological  functioning  over  the  course 
of  a  day.  Sleepiness,  for  example,  typically  is  at  a  peak  between  3  a.m.  and  5  a.m.  with  another 
increase  occurring  between  3  p.m.  and  5  p.m.  When  an  individual’s  daily  schedule  is  changed 
by  a  change  in  shift  schedule  or  travel  to  a  different  time  zone,  circadian  rhythms  are  disrupted 
and  performance  decrements  will  occur  until  a  new  pattern  is  established. 

8.1.3  Emotional  Stress 

Stress  is  an  internal  psychological  and  physiological  response  to  threatening  events  or  conditions 
that  require  unusual  changes  in  behavior  or  adaptation.  The  amount  of  stress  an  individual 
experiences  in  any  given  context  increases  when  the  individual  perceives  that  the  demands  of  the 
situation  are  perceived  as  exceeding  his  or  her  capabilities  to  cope. 
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Because  a  stress  response  depends  upon  the  individual’s  appraisal  of  his  or  her  ability  to  cope 
with  the  situation,  individuals  will  differ  in  the  events  and  conditions  that  they  experience  as 
stressful.  Common  sources  of  potential  emotional  stress  include  interpersonal  conflicts  at  home 
or  on  the  job,  grief  and  loss,  unpredictability  in  one’s  personal  or  work  life,  and  any  events  at 
home  or  at  work  that  reduce  self-esteem. 

Stress  may  impair  task  performance  in  several  ways.  Personnel  may  become  distracted  and 
unable  to  focus  on  the  task  and  so  commit  errors.  Or,  stress  may  cause  a  worker  to  become  too 
focused  on  one  aspect  of  a  task  to  the  exclusion  of  others  or  have  difficulty  determining  when 
and  how  to  act.  Physiological  stress  responses  may  also  reduce  fine  motor  coordination.  If 
stress  persists  over  a  long  period  of  time,  it  can  cause  physical  and  mental  illnesses. 

Stress  may  also  adversely  affect  team  performance.  Team  members  typically  communicate  less 
under  stressful  conditions  and  may  fail  to  exchange  information  needed  to  succeed  at  a  task.  Or, 
team  members  may  lose  sight  of  team  goals  and  focus  instead  on  their  personal  goals  and  needs. 

Experience  with  a  stressor  reduces  the  stress  response.  Successful  past  experiences  in  surviving 
stressful  events  and  conditions  increase  an  individual’s  confidence  in  his  or  her  ability  to  cope, 
so  that  less  stress  is  experienced  when  similar  situations  are  encountered  again. 

8.1.4  Illness 

Physical  and  mental  illnesses  may  also  cause  errors.  The  effects  of  physical  illness  on  cognitive 
and  motor  performance  depend  upon  the  nature  of  the  illness  itself.  Most  physical  illnesses  are 
accompanied  by  fatigue.  Some  may  cause  stress.  Similarly,  the  effects  of  mental  illnesses 
depend  upon  the  nature  of  the  illness  and  the  extent  to  which  symptoms  are  controllable  (and  are 
controlled)  with  medication. 

8.1.5  Combinations  of  Factors 

The  effects  on  performance  of  combinations  of  these  impairment-causing  factors  may  be 
synergistic  and  they  may  also  interact  with  other  conditions  in  the  workplace.  For  example, 
fatigue  may  increase  the  experience  of  emotional  stress.  Or,  physical  illness  may  reduce  an 
individual’s  tolerance  for  environmental  conditions,  such  as  heat  or  noise. 

8.2  DIRECT  CAUSES  OF  FITNESS-FOR-DUTY-RELATED  ERRORS 

A  direct  cause  of  an  error  resulting  from  personnel  impairment  describes  characteristics  of  the 
impairment  that  caused  task  performance  to  fail.  There  are  a  number  of  ways  in  which 
impairment  may  cause  or  contribute  to  an  error.  These  include: 

Substance  use  -  Personnel  capabilities  were  reduced  by  the  use  of  drugs  or  alcohol  prior 
to  or  during  working  hours,  resulting  in  errors. 

Excessive  consecutive  work  hours  -  Personnel  became  fatigued  because  of  working  too 
many  consecutive  hours  or  working  too  long  on  the  same  task.  As  a  result,  for  example, 
mental  fatigue  due  to  long  hours  performing  a  repetitious  task  without  rest  breaks  caused 
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a  momentary  lapse  in  monitoring  of  indications  with  the  result  that  a  safety  parameter 
was  exceeded. 

Inadequate  rest  -  Excessive  overtime  with  insufficient  time  off-duty  created  a  “sleep 
debt.”  As  a  result,  for  example,  personnel  vigilance  was  reduced  and  changes  to 
parameters  were  not  detected. 

Circadian  rhythms  -  An  individual’s  circadian  rhythms  were  disrupted  by  scheduled 
changes,  such  as  shift  rotation  or  jet  lag.  Or,  capabilities  were  reduced  because  task 
performance  occurred  during  a  natural  “trough”  in  physiological  functioning.  As  a  result, 
for  example,  steps  were  performed  incorrectly  during  a  task  because  the  worker  did  not 
recall  the  correct  action  sequence. 

Emotional  stress  -  Events  or  conditions  in  an  individual’s  personal  or  work  life  affected 
the  individual’s  task  focus  or  motor  coordination. 

Illness  -  Worker  capabilities  to  perform  a  task  were  reduced  by  the  symptoms  of  physical 
or  mental  illness  that  were  not  controlled  by  medication.  For  example,  judgment  and 
decision  making  may  be  impaired,  leading  to  errors. 

Combination  of  impairments  -  Combinations  of  impairing  factors  reduced  worker 
capabilities,  leading  to  errors. 

8.3  PROGRAMMATIC  CAUSES  OF  FITNESS-FOR-DUTY  ERRORS 

Barriers  to  fitness-for-duty-related  errors  include  licensee  programs  for  the  detection  and 
prevention  of  potential  or  actual  impairment,  as  well  as  the  individual  responsibility  of 
workers  to  decline  assignments  if  they  are  impaired  for  any  reason.  The  latter  barrier  is  a 
weak  one,  however,  because  humans  are  generally  over-confident  of  their  capabilities  when 
under  the  influence  of  drugs  or  alcohol,  or  are  stressed,  fatigued  or  ill.  Other  factors  that 
may  discourage  self-reporting  include  the  fear  of  losing  access  authorization,  an  operating 
license  or  extra  income  from  overtime.  Licensee  programs  that  may  be  implicated  in  errors 
caused  by  personnel  impairment  include: 

Access  Authorization  -  This  program  is  responsible  for  assuring  that  individuals 
with  access  to  special  nuclear  materials  are  reliable  and  trustworthy.  Psychological 
examinations  and  background  investigations  are  two  of  the  techniques  used. 

Weaknesses  in  this  program  may  allow  impaired  individuals  to  have  unescorted 
access  to  vital  areas  in  a  plant. 

Fitness-for-Duty  -  Licensee  fitness-for-duty  programs  are  primarily  responsible  for 
detecting  and  preventing  impaired  personnel  from  performing  tasks  that  may  affect 
public  health  and  safety.  Medical  evaluations  of  personnel,  behavioral  observation 
programs,  employee  assistance  programs  and  drug  and  alcohol  testing  are  used  to 
detect  impairment.  Weaknesses  in  this  program  may  allow  impaired  personnel  to 
have  access  to  vital  areas  in  a  plant  where  they  could  commit  errors. 
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Operator  Licensine  -  NRC  requirements  for  obtaining  and  maintaining  an  operating 
license  also  include  medical  and  psychological  examinations  to  screen  for  potential 
health  conditions.  Weaknesses  in  this  program  may  set  the  stage  for  health 
conditions  to  adversely  affect  an  operator's  ability  to  perform  his  or  her  tasks. 

Overtime  Policies  and  Practices  -  The  NRC  issued  Generic  Letter  82-12  that 
provides  guidance  for  limiting  work  hours  to  reduce  on-the-job  fatigue  and  the 
potential  consequences  for  task  performance.  Licensee  Technical  Specifications  and 
administrative  procedures  also  define  work-hour  limitations.  Routine  authorization 
for  work  hours  in  excess  of  those  recommended  may  result  in  fatigued  workers. 

Further,  a  practice  of  excluding  training  or  meetings  that  occur  outside  of  an 
individual’s  normal  work  schedule  from  work-hour  limitations  will  also  contribute  to 
fatigue. 

Shift  Scheduling  -  Shift  scheduling  may  also  affect  the  likelihood  that  personnel  will 
show  performance  decrements  due  to  fatigue.  A  change  in  the  assigned  shift  or  a 
rotating  shift  schedule  will  disrupt  circadian  rhythms  and  may  increase  the  likelihood 
of  errors. 

Safety  Culture  -  The  effectiveness  of  self-reporting  and  behavioral  observation  programs 
depends  greatly  upon  the  safety  culture  at  a  site.  For  example,  if  self-reporting  of 
impairment  or  reporting  an  impairment  concern  about  another  staff  member  consistently 
results  in  disciplinary  action,  then  supervisors  and  workers  may  be  reluctant  to  report 
other  staff  members  who  appear  to  be  impaired.  On  the  other  hand,  if  individuals  who 
have  come  to  work  under  some  form  of  stress  are  treated  fairly  and  with  concern, 
personnel  will  report  more  frequently.  If  the  licensee’s  culture  emphasizes  safety  over 
other  goals,  personnel  may  be  willing  to  turn  down  overtime  and  monitor  their  own 
fatigue  levels,  even  if  turning  down  the  opportunity  results  in  a  loss  of  income. 

8.4  ADDITIONAL  RESOURCES  ON  FITNESS  FOR  DUTY 

•  U.S.  Code  of  Federal  Regulations,  Part  11,  Criteria  and  procedures  for  determining 
eligibility  for  access  to  or  control  over  special  nuclear  material.  Title  10,  Energy  (revised 
periodically).  Washington,  DC:  U.S.  Government  Printing  Office. 

•  U.S.  Code  of  Federal  Regulations,  Part  26,  Fitness  for  duty  programs.  Title  10,  Energy 
(revised  periodically).  Washington,  DC:  U.S.  Government  Printing  Office. 

•  U.S.  Code  of  Federal  Regulations,  Part  55,  Operators  licenses,  Title  10,  Energy  (revised 
periodically).  Washington,  DC:  U.S.  Government  Printing  Office. 

•  U.S.  Code  of  Federal  Regulations,  Part  73,  Physical  protection  of  plants  and  materials. 
Title  10,  Energy  (revised  periodically).  Washington,  DC:  U.S.  Government  Printing 
Office. 
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9  KNOWLEDGE,  SKILLS  AND  ABILITIES 


9.1  KNOWLEDGE,  SKILLS  AND  ABILITIES  IN  HUMAN  PERFORMANCE 

Many  of  the  job  positions  at  licensee  sites  require  extensive  and  specialized  KSAs  for  correct 
task  performance.  Knowledge  is  a  set  of  facts,  factual  information,  a  method  of  analysis  or  the 
application  of  methods  and  facts  to  successfully  perform  a  task.  A  skill  is  a  motor  or  mental 
capability  such  as  the  ability  to  open  a  valve  or  operate  a  controller.  Ability  is  the  combination 
of  knowledge  and  skills  required  to  perform  a  task.  Mastery  is  the  process  of  achieving  the 
requisite  KSAs  to  perform  a  job  or  task  safely  and  competently. 

A  KSA  deficiency  is  one  of  the  more  frequently  identified  causes  for  human  error.  There  are 
four  basic  ways  in  which  an  error  may  occur  as  a  result  of  KSA  deficiencies.  These  are: 

•  The  worker  did  not  receive  training  and  so  did  not  master  the  requisite  KSA(s) 

•  The  worker  was  trained,  but  the  training  did  not  result  in  KSA  mastery 

•  The  worker  was  trained  and  mastered  the  KSA,  but  did  not  retain  it  over  time 

•  The  worker  mastered  the  requisite  KSA,  but  did  not  apply  it  to  the  task. 

The  potential  risk  impacts  of  personnel  performing  tasks  without  the  requisite  KSAs  are  the  basis 
for  NRC  and  industry  efforts  to  improve  training  programs.  Not  all  KSA  errors  are  caused  by 
training  deficiencies,  however.  As  will  be  discussed  below,  a  mental  lapse  or  a  momentary  loss 
of  situational  awareness  may  also  cause  KSA-related  errors.  In  addition,  for  some  jobs,  a  certain 
level  of  proficiency  is  expected  when  personnel  are  hired  into  the  position  or  the  services  of 
contractors  are  obtained.  In  these  cases,  human  resources  screening  and  selection  processes  or 
procurement  processes  for  contractor  services  may  play  a  role  in  preventing  KSA  errors. 

9.1.1  Systems  Approach  to  Training 

Licensee  training  programs  are  presently  conducted  in  accordance  with  the  principles  of  the 
systems  approach  to  training  (SAT),  which  is  also  called  performance-based  training  (PBT). 
The  NRC  assures  that  training  is  conducted  in  accordance  with  10  CFR  50.120,  “Training  and 
Qualification  of  Nuclear  Power  Plant  Personnel”  and  10  CFR  55.4,  “Operators  Licenses 
(Definitions).”  The  systems  approach  to  training  means  that  a  training  program  includes  the 
following  five  elements: 

•  Systematic  analysis  of  the  jobs  to  be  performed 

•  Learning  objectives  derived  from  the  analysis,  which  describe  desired  performance 
after  training 

•  Training  design  and  implementation  based  on  the  learning  objectives 

•  Evaluation  of  trainee  mastery  of  the  objectives  during  training 

•  Evaluation  and  revision  of  the  training  based  on  the  performance  of  trained  personnel 
in  the  job  setting. 
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As  noted  in  the  Statements  of  Consideration  for  the  1987  amendment  to  10  CFR  55.4,  a 
licensee’s  training  program  is  considered  NRC-approved  when  it  is  accredited  by  the  National 
Nuclear  Accrediting  Board. 

There  are  currently  nine  licensee  training  programs  subject  to  accreditation,  as  follows: 

1 .  Licensed  and  non-licensed  operators 

2.  Shift  supervisor 

3.  Shift  technical  advisor 

4.  Instrument  and  control  technician 

5.  Electrical  maintenance  personnel 

6.  Mechanical  maintenance  personnel 

7.  Radiological  protection  technician 

8.  Chemistry  technician 

9.  Engineering  support  personnel 

These  training  programs  identify  the  required  KSAs  to  successfully  function  in  a  job.  A  job  is 
defined  by  a  set  of  tasks  to  be  mastered  by  the  worker.  These  tasks  are  analyzed  to  identify  the 
KSAs  they  require.  The  KSAs  are  then  consolidated  into  a  master  taxonomy  of  KSAs  for  each 
job.  Learning  objectives  for  training  are  prepared  from  the  taxonomies.  Mastery  of  the  learning 
objectives  equates  to  mastery  of  the  KSAs  and  a  successful  training  program  assures  that  each 
worker  is  qualified  to  perform  the  various  tasks  that  comprise  his  or  her  job. 

Performance-based  training  programs  were  implemented  and  first  accredited  during  the  late 
1980s.  Most  nuclear  power  plant  personnel  have  been  trained  under  these  programs. 

9.1.2  Identifying  KSAs  with  Job  and  Task  Analysis 

Job  and  task  analysis  (JTA)  is  a  systematic  method  for  identifying  the  KSAs  that  are  required 
for  successful  performance  of  the  tasks  associated  with  a  job.  The  JTA  is  used  to  identify  the 
tasks  for  which  training  is  necessary  and  may  be  used  to  identify  requirements  for  personnel 
screening  and  selection. 

Tasks  are  analyzed  in  the  JTA  based  upon  their  importance,  frequency  and  difficulty. 

•  An  important  task  is  one  that  is  critical  to  successful  job  performance.  For  example,  the 
operator  actions  that  are  modeled  in  plant  probabilistic  risk  assessments  are  important,  so 
training  for  mastery  is  required. 

•  An  infrequently  performed  task  is  one  that  may  not  be  performed  often  enough  for 
personnel  to  maintain  mastery. 

•  A  difficult  task  is  one  that  is  complex.  For  example,  the  task  may  involve  multiple 
decisions  based  upon  dynamic  plant  states. 

The  KSAs  required  for  these  tasks  are  affected  by  the  quality  of  the  procedures  that  are  available 
and  the  characteristics  of  the  human-system  interface  (HSI).  For  example,  if  controls  are  easily 
manipulated  and  displays  easy  to  understand,  then  the  operator  may  not  need  to  master  a  large 
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body  of  detailed  information  to  operate  the  system.  Similarly,  if  the  procedures  for  a  task  are 
clearly  written  and  easily  understood,  then  the  worker  might  not  need  to  memorize  the  exact 
sequence  of  actions  required  to  repair  a  particular  component,  because  the  procedure  steps  will 
guide  the  worker  through  the  task. 

Changes  to  equipment,  the  HSI  and  the  as-written  procedures  may  require  an  update  to  the  JTA. 
When  equipment  design  or  procedures  are  changed,  training  program  personnel  will  reassess  the 
adequacy  of  the  existing  KSAs  to  determine  if  additional  training  is  required,  or  whether  current 
training  should  be  revised  or  deleted.  Revisions  to  existing  training  programs  and  new  training 
may  also  be  required  as  operating  experience  provides  lessons  learned.  Personnel  screening  and 
selection  criteria  or  contractor  requirements  may  also  be  impacted. 

9.1.3  Training 

Training  to  master  the  KSAs  required  for  a  job  may  be  obtained  from  a  variety  of  sources. 
Whether  the  licensee  provides  the  training  or  it  is  obtained  from  other  sources  (e.g.,  trade 
schools,  universities,  contractor  organizations),  there  are  several  factors  that  may  result  in 
personnel  not  mastering  the  required  KSAs  for  a  job.  These  include  course  design  and  delivery 
methods,  course  completion,  and  training  frequency. 

Course  design  begins  when  the  learning  objectives  have  been  identified.  The  design  process 
consists  of  determining  the  delivery  methods  (e.g.,  classroom,  simulator,  on-the-job  training), 
number  of  hours  required  to  cover  the  materials,  instructor  qualifications  and  so  on.  Although 
some  methods,  materials  and  instructors  may  be  more  effective  or  efficient  than  others,  the 
important  issue  is  that  the  course  content  is  complete  and  addresses  all  of  the  relevant  KSAs,  so 
that  the  learning  objectives  are  met  and  the  KSAs  mastered. 

Another  determinant  of  KSA  mastery  is  course  completion.  Although  this  factor  appears 
obvious,  there  are  often  competing  demands  on  personnel  that  may  pull  them  out  of  training  at 
times.  As  a  result,  they  may  miss  the  instruction  related  to  specific  KSAs.  Testing  may  not 
identify  the  KSA  deficiency  because  it  is  impossible  to  test  mastery  of  all  KSAs.  Sampling 
techniques  are  used  to  generate  examinations.  If  attendance  and  participation  are  not  controlled, 
some  personnel  may  miss  training  on  specific  KSAs  and  testing  may  not  identify  the  deficiencies 
before  an  error  is  committed. 

9.1.4  Testing 

Testing  is  the  primary  means  used  to  evaluate  KSA  mastery.  In  order  to  assure  that  personnel 
are  competent  to  perform  their  jobs,  the  testing  requirements  should  be  valid  for  the  job.  There 
are  three  kinds  of  validity  that  are  important  for  a  mastery  test: 

•  Content  validity  -  the  test  items  are  directly  related  to  job  performance  by  ensuring  they 
match  the  learning  objectives  and  are  appropriately  weighted 

•  Operational  validity  -  the  test  items  address  the  mental  and  psychomotor  activities  that 
are  performed  on  the  job 
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•  Discriminate  validity  -  the  test  items  differentiate  between  workers  who  have  mastered 
KSAs  required  to  perform  the  job  and  those  who  have  not. 

Most  training  programs  do  not  require  perfect  performance  on  test  items  for  all  KSAs  to 
demonstrate  mastery  of  the  subject.  As  an  example,  a  score  of  80%  on  most  components  of  the 
test  is  required  in  the  operator  licensing  examination  process.  A  score  of  100%  is  not  required, 
in  part,  because  the  validity  and  reliability  of  test  items  vary. 

The  examination  process  should  identify  critical  tasks,  however.  For  operators,  critical  tasks  are 
those  actions  that  are  so  important  to  safety  that  a  competent  operator  is  expected  to  correctly 
perform  these  tasks  every  time  to  demonstrate  mastery.  Critical  tasks  typically  form  a  small 
subset  of  the  overall  group  of  tasks  to  be  mastered  for  any  job.  Emphasis  on  critical  tasks  and 
their  associated  KSAs  in  training  and  testing  is  important  to  reduce  the  likelihood  of  error. 

9.1.5  Proficiency  Training 

Another  factor  affecting  KSA  mastery  is  forgetting.  An  individual’s  ability  to  perform  a  task  will 
degrade  over  time  unless  the  relevant  KSAs  are  refreshed.  Proficiency  training  (i.e.,  refresher) 
will  be  required  for  some  tasks  to  maintain  the  level  of  mastery  that  was  demonstrated  following 
initial  training.  One  function  of  training  programs  is  to  identify  those  tasks  that  require 
proficiency  training. 

If  certain  tasks  are  performed  frequently,  proficiency  training  may  be  unnecessary.  By 
performing  a  task,  personnel  practice  the  task  and  obtain  feedback  regarding  successful  task 
mastery.  Task  performance  refreshes  the  KSAs  and  successful  task  performance  verifies  that 
proficiency  has  been  maintained. 

“Just-in-time”  training  may  be  used  for  infrequently  performed  and  difficult  tasks.  “Just-in- 
time”  training  techniques  may  include  a  comprehensive  pre-job  briefing,  practice  runs  on  a 
mock-up  or  a  simulator  familiarization  session.  Determination  of  the  periodicity  required  to 
refresh  KSAs  is  part  of  the  design  of  the  training  and  requalification  program,  although  actual 
“just-in-time”  training  may  be  triggered  and  administered  by  a  different  process,  such  as  work 
planning  and  control. 

9.1.6  Training  Evaluation  and  Revision 

An  important  aspect  of  a  performance-based  training  system  is  the  constant  evaluation  and 
revision  of  the  training  program.  This  mechanism  assures  that  changes  in  plant  configuration, 
equipment  modifications,  procedural  changes  and  lessons  learned  from  operating  experience  are 
included  in  learning  objectives  and  addressed  in  training  program  design.  An  effective  training 
program  is  dynamic  as  the  plant  organization  changes  and  learns.  If  the  training  program  ceases 
to  capture  changes  in  the  plant  and  industry,  training  will  not  provide  the  necessary  KSAs  to 
assure  successful  task  performance. 
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9.1.7  Cognitive  Errors:  Loss  of  Situational  Awareness  and  Mental  Lapses 

Two  fundamental  sources  of  human  error  that  are  not  associated  with  KSA  mastery  are  a  loss  of 
situational  awareness  and  a  mental  lapse.  A  loss  of  situational  awareness  or  a  mental  lapse 
occurs  when  personnel  have  previously  demonstrated  mastery  of  a  KSA  but  cannot  recall  it  at 
the  required  time  to  prevent  an  error.  An  example  would  be  failure  to  trip  a  pump  when  pressure 
reached  a  certain  value.  If  the  operator  did  not  recognize  that  pressure  had  reached  that  value, 
the  problem  was  caused  by  a  loss  of  situational  awareness.  If  the  operator  recognized  that 
pressure  had  reached  the  pump  trip  criterion  but  still  did  not  trip  the  pump,  the  problem  would  be 
a  mental  lapse.  In  each  case,  if  the  operator  had  been  directly  asked  when  he  or  she  needed  to 
trip  the  pump,  the  operator  would  have  correctly  responded,  “when  pressure  reached  the  trip 
criterion.” 

9. 1.7.1  Loss  of  Situational  Awareness 

Loss  of  situational  awareness  occurs  when  a  worker  does  not  recognize  that  a  certain  KSA 
applies  to  the  task  that  he  or  she  is  performing.  The  worker  has  mastered  the  KSA  and,  if  asked 
in  a  different  setting,  would  be  able  to  demonstrate  this  mastery.  There  are  four  elements 
required  for  a  finding  of  a  loss  of  situational  awareness: 

1 .  The  KSA  was  essential  for  satisfactory  task  performance 

2.  The  individual  received  training  to  adequately  complete  the  task 

3.  The  individual  mastered  the  KSA  required  for  task  performance 

4.  The  individual  did  not  recognize  that  the  KSA  was  applicable  to  the  task. 

There  are  several  methods  available  to  prevent  the  likelihood  of  errors  due  to  a  loss  of  situational 
awareness.  Situational  awareness  can  be  improved  through  “just-in-time  training”  that  focuses 
on  “what-if  ’  scenarios  for  events  that  are  pre-planned.  This  allows  the  individual  to  think 
through  the  various  situations  that  may  be  encountered  during  the  work  activity.  Emphasizing 
rule-based  precautions  during  training  may  also  be  helpful  (e.g.,  “Always  check  Tech  Specs 
whenever  any  component  is  declared  inoperable”),  but  will  not  prevent  all  losses  of  situational 
awareness.  Placing  the  staff  member  into  the  situation  in  which  a  KSA  will  be  applied,  such  as  a 
simulator,  is  also  useful  in  preventing  a  loss  of  situational  awareness.  However,  there  are  so 
many  potential  event  paths  in  a  nuclear  power  plant  that  it  is  unlikely  that  simulator-based 
training  can  address  every  possible  situation. 

The  most  effective  corrective  actions  to  enhance  situational  awareness  for  unplanned  events  are 
to  ensure  that  prompts  or  reminders  are  included  in  job  performance  aids.  This  type  of  support 
may  include: 

•  Adding  notes  or  cautions  to  procedures 

•  Adding  annunciators  and  alarms  that  call  attention  to  equipment  conditions 

•  Eliminating  or  conditionally  suppressing  unnecessary  annunciators  that  may  overwhelm 
operators  during  events 

•  Improving  the  human-system  interface. 
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9. 1.7.2  Mental  Lapse 

Another  source  of  error  is  the  mental  lapse,  or  a  momentary  lapse  in  recall  for  the  correct  KSA 
when  it  is  required.  Lapses  may  be  random,  or  may  be  related  to  performance  shaping  factors, 
such  as  fatigue,  environmental  conditions  or  stress.  Often,  the  lapse  occurs  because  the 
individual  becomes  distracted  or  unfocused.  For  example,  an  individual  may  have  been  working 
through  one  procedure  when  the  task  was  interrupted  by  the  need  to  implement  a  higher  priority 
procedure.  The  staff  member  may  have  intended  to  complete  the  initial  procedure,  but  was 
distracted  by  the  other,  higher  priority  activities  and  did  not  remember  to  return  to  the  first 
procedure. 

Mental  lapses  are  identified  when  the  following  four  conditions  are  met: 

1 .  The  KSA  was  essential  for  satisfactory  task  performance 

2.  The  individual  received  training  to  adequately  complete  the  task 

3.  The  individual  previously  demonstrated  mastery  of  the  KSA(s)  required  to  complete 
the  task 

4.  The  individual  did  not  recall  the  KSA(s)  when  required. 

Although  training  programs  cannot  prevent  mental  lapses,  personnel  can  be  trained  to  recognize 
the  warning  signs  of  conditions  that  may  increase  the  likelihood  of  a  lapse  and  use  various 
strategies  to  minimize  their  occurrence.  These  strategies  may  include  self-checking  programs  or 
stress  management  techniques. 

Reducing  or  eliminating  the  performance-shaping  factors  that  momentarily  distract  or  overload 
cognitive  processes  may  also  reduce  the  likelihood  of  mental  lapses.  Corrective  actions  to 
minimize  or  eliminate  the  performance-shaping  factors  that  caused  a  lapse  will  be  more  effective 
than  remedial  training  on  the  KSA,  given  that  the  individual  has  already  mastered  it. 

9.1.8  Personnel  Selection  and  Contracting 

Licensees  often  hire  new  staff,  promote  staff  to  new  positions,  or  augment  the  existing  staff  with 
contractor  personnel.  Personnel  selection  processes  identify  the  best-qualified  individual  for  a 
job  using  several  different  methods,  which  typically  include  an  evaluation  of  previous  job 
experience,  education  and  training.  Personality,  ability  and  proficiency  tests  may  also  be 
administered.  These  methods  are  intended  to  ensure  that  new  hires  and  the  staff  who  are 
promoted  either  possess  the  KSAs  required  for  the  job  or  have  the  ability  to  benefit  from  training 
for  the  job.  Procurement  processes  specify  the  qualifications  that  contractor  personnel  are 
required  to  have,  although  licensees  may  also  provide  site-specific  training  to  contractor 
personnel.  Weaknesses  in  the  personnel  selection  and  procurement  processes  may  result  in  work 
being  performed  by  individuals  who  have  not  mastered  the  necessary  KSAs  for  the  task  and  so 
lead  to  errors. 
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9.2  DIRECT  CAUSES  OF  KSA-RELATED  ERRORS 


A  direct  cause  of  a  KSA  error  describes  the  reason  that  the  requisite  KSA  was  not  applied  to  task 
performance.  The  direct  cause  of  the  error  may  be: 

No  KSA  -  The  worker  did  not  possess  the  KSA  required  for  successful  task  performance. 
For  example,  certain  skills  were  required  to  use  a  particular  type  of  self-contained 
breathing  apparatus  (SCBA)  but  the  worker  did  not  possess  those  skills.  As  a  result,  the 
individual  was  exposed  to  airborne  contamination  because  the  SCBA  did  not  fit  properly. 

Inadequate  mastery  -  The  individual  had  not  mastered  the  KSA.  In  this  case,  the 
individual  had  received  some  form  of  training,  but  it  was  inadequate.  For  example,  a 
maintenance  technician  was  required  to  review  a  new  revision  to  a  procedure  on  her  own 
time.  She  completed  the  review,  but  when  it  was  time  to  use  the  procedure,  she  found 
that  certain  steps  in  the  procedure  did  not  make  sense  to  her  and  she  was  unable  to  follow 
it.  As  a  result,  she  took  incorrect  actions. 

Inadequate  retention  -  The  individual  had  mastered  the  KSA  but  had  forgotten  how  to 
perform  important  components  of  the  task,  and  so,  for  example,  performed  steps  out  of 
sequence. 

Loss  of  situational  awareness  -  The  individual  had  mastered  the  KSA  but  did  not 
recognize  the  KSA  applied  to  the  current  situation  and  so  committed  an  error.  For 
example,  a  unit  supervisor  had  mastered  knowledge  regarding  the  conditions  under  which 
it  is  necessary  to  post  a  fire  watch,  but  failed  to  recognize  that  a  fire  watch  was  required 
for  a  particular  welding  job.  As  a  result,  sparks  from  the  welding  task  caused  a  small  fire. 

Mental  lapse  -  The  individual  had  mastered  the  KSA  but  failed  to  recall  it  and  so  did  not 
apply  it  to  performing  the  task.  For  example,  a  security  guard  became  distracted  by  an 
incident  that  was  being  discussed  over  the  radio  and  so  failed  to  check  that  a  door  was 
securely  locked. 

9.3  PROGRAMMATIC  CAUSES  OF  KSA-RELATED  ERRORS 

The  training  program  is  responsible  for  assuring  that  personnel  master  the  necessary  KSAs  to 
perform  their  tasks.  NUREG-1220,  Training  Review  Criteria  and  Procedures,  provides  detailed 
review  criteria  for  assessing  training  program  effectiveness.  Several  key  training  program 
weaknesses  are  also  described  here.  In  addition,  other  licensee  programs  or  processes  that  may 
cause  or  contribute  to  KSA-related  errors  are  also  listed. 

9.3.1  Training  Program  Weaknesses 

Job  and  Task  Analysis  -  The  JTA  did  not  identify  and  characterize  all  of  the  important 
KSAs  for  a  job  position.  As  a  result,  training  did  not  address  them  and  workers  were  not 
prepared  to  perform  some  tasks  correctly.  For  example,  operators  violated  Technical 
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Specifications  because  they  had  not  been  trained  to  understand  their  applicability  to  the 
current  situation. 

Training  Design  and  Delivery  -  Training  was  provided  but  the  design  and  delivery  did 
not  assure  KSA  mastery.  For  example,  the  course  content  may  not  have  addressed  all  of 
the  important  KSAs  for  the  job,  course  delivery  methods  may  have  been  inappropriate  for 
the  KSA  (e.g.,  classroom  lectures  to  teach  a  skill  with  no  opportunity  to  practice),  or  the 
instructors  were  not  qualified  to  teach  the  course. 

Training  Completion  -  Student  attendance  and  participation  were  not  managed.  As  a 
result,  an  individual  or  group  of  workers  missed  instruction  related  to  important  KSAs, 
did  not  master  them  and  could  not  perform  the  task  correctly  when  required. 

Testing  -  KSA  mastery  was  not  evaluated  or  testing  was  invalid.  As  a  result,  students 
who  had  not  mastered  important  KSAs  were  not  detected  and  so  were  allowed  to  perform 
tasks  for  which  they  were  not  qualified. 

Frequency  -  Proficiency  training  was  not  provided  or  was  not  provided  with  sufficient 
frequency.  As  a  result,  KSA  mastery  degraded  and  personnel  could  no  longer  perform 
some  tasks  correctly. 

Evaluation  and  Revision  -  Lessons  learned  related  to  training  weaknesses  were  not 
communicated  or  tracked  and  so  training  was  not  revised  to  address  them.  Or,  changes  in 
plant  equipment,  work  practices  and  requirements  did  not  result  in  training  revisions.  As 
a  result,  some  staffs  KSAs  were  incomplete  or  inaccurate. 

9.3.2  Other  Programmatic  Weaknesses 

Human  Resources  -  Personnel  selection  processes  did  not  ensure  that  new  hires  or  newly 
promoted  individuals  had  mastered  the  KSAs  required  for  the  job.  As  a  result,  some  staff 
did  not  possess  the  KSAs  to  perform  effectively. 

Procurement  -  Licensee  processes  for  bringing  contractor  personnel  on-site  did  not 
assure  that  the  contractors  had  mastered  the  KSAs  required  for  the  job. 

Work  Planning  and  Control  —  The  work  planning  and  control  process  did  not  assign 
qualified  individuals  to  the  task.  As  a  result,  personnel  who  had  not  mastered  the  KSAs 
required  performed  a  task  and  committed  errors. 

Shift  Staffing  -  An  inadequate  number  of  qualified  personnel  were  assigned  to  each  shift. 
As  a  result,  planned  work  could  not  be  executed  or  unplanned  conditions  or  events  could 
not  be  managed. 

Human  Factors  Engineering  -  Procedures,  equipment  labeling,  and  human-system 
interfaces  were  inadequate  to  assist  personnel  in  maintaining  situational  awareness.  As  a 
result,  workers  were  unable  to  complete  a  repair  task  because  the  combination  of 
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inadequate  training  with  poor  procedures  and  labeling  prevented  them  from  locating  the 
component  on  which  the  task  was  to  be  performed. 

Industrial  Hygiene  and  Radiation  Protection  -  Weaknesses  in  these  programs  may  result 
in  workers  performing  tasks  under  environmental  conditions  that  promote  errors.  For 
example,  excessive  noise  distracted  staff  from  performing  their  tasks,  leading  to  a  mental 
lapse. 

9.4  ADDITIONAL  RESOURCES  ON  KSAs  AND  TRAINING 

•  U.S.  Code  of  Federal  Regulations,  Part  50.120,  Training  and  qualification  of  nuclear 
power  plant  personnel.  Title  10,  Energy  (revised  periodically).  Washington,  DC:  U.S. 
Government  Printing  Office. 

•  U.S.  Code  of  Federal  Regulations,  Part  55.4,  Operators  licenses  (definitions).  Title  10, 
Energy  (revised  periodically).  Washington,  DC:  U.S.  Government  Printing  Office. 

•  U.S.  Nuclear  Regulatory  Commission  (2000).  Qualification  and  training  of  personnel 
for  nuclear  power  plants  (Regulatory  Guide  1.8,  Rev.  3).  Washington,  DC:  U.S. 

Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1999).  Operator  licensing  examination  standards 
for  power  reactors  (NUREG-1021).  Washington,  DC:  U.S.  Nuclear  Regulatory 
Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1998).  Knowledge  and  abilities  catalog  for 
nuclear  power  plant  operators:  Pressurized  water  reactors  (NUREG-1 122,  Rev.  2). 
Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1998).  Knowledge  and  abilities  catalog  for 
nuclear  power  plant  operators:  Boiling  water  reactors  (NUREG-l  123,  Rev.  2). 
Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1996).  Nuclear  power  plant  simulation  facilities 
for  use  in  operator  license  examinations  (Regulatory  Guide  1.149,  Rev.  2).  Washington, 
DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1993).  Training  review  criteria  and  procedures 
(NUREG-1220,  Rev.l).  Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 
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10  ATTENTION  AND  MOTIVATON 


10.1  ATTENTION  AND  MOTIVATION  IN  HUMAN  PERFORMANCE 

Attention  and  motivation  are  often  identified  as  causes  for  error.  “Inattention  to  detail”  and 
“complacency,”  for  example,  are  frequently  cited  as  causal  factors  in  licensee  problem  reports. 
The  evidence  supporting  these  conclusions  is  often  weak,  however. 

Determining  the  role  of  attention  or  motivation  in  a  human  error  is  difficult  outside  of  a 
laboratory  or  simulator  setting.  Attention  and  motivation  are  internal  states  that  cannot  be 
measured  directly.  In  the  laboratory,  the  experimenter  can  use  sensitive  instruments  to  track  eye 
movements  and  record  focus  times  as  measures  of  attention,  for  example,  or  can  establish  control 
over  the  incentives  presented  to  subjects  to  manipulate  motivation  levels.  Recordings  of  workers 
“thinking  aloud”  as  they  perform  tasks  also  provide  insights  into  attention  and  motivation.  In  an 
investigation,  however,  real-time,  objective  measures  of  attention  or  motivation  cannot  be 
obtained  because  the  investigation  necessarily  occurs  after  the  fact.  As  a  result,  the  investigator 
must  rely  on  self-reports  and  inference,  which  are  subject  to  the  biases  and  inaccuracies 
discussed  in  Section  3. 

Attributing  causality  to  workers’  attention,  attitudes,  motivations  or  traits  may  be  common 
because  it  is  consistent  with  the  “fundamental  attribution  error.”  As  mentioned  in  Section  3,  this 
“error”  is  a  natural  human  tendency  in  how  we  explain  another’s  behavior  and  appears  to  be 
“hard-wired”  into  the  human  perceptual  system.  In  the  absence  of  compelling  evidence  that 
some  characteristic  of  the  work  environment  affected  the  workers’  actions,  investigators  may 
resort  to  this  “default”  explanation  and  conclude  that  the  workers  were  not  paying  attention  or 
lacked  the  motivation  to  perform  their  work  correctly.  In  reviewing  a  licensee  problem  report 
that  cites  attention  and  motivation  as  causal  factors,  it  may  be  necessary  for  NRC  inspectors  to 
carefully  assess  the  evidence  provided  to  ensure  that  it  supports  the  conclusions. 

10.1.1  Attention 

The  term,  “cognition,”  refers  to  how  people  attend  to  and  process  information  in  making 
decisions  and  performing  tasks.  A  useful  description  of  the  cognitive  processes  involved  in  task 
performance  can  be  found  in  NUREG/CR-6126,  “Cognitive  Skill  Training  for  Nuclear  Power 
Plant  Operational  Decision  Making,”  and  is  summarized  here. 

The  information  processing  required  for  task  performance  can  be  broken  down  into  four  stages. 
These  are  (1)  detection  and  monitoring,  (2)  situation  assessment,  (3)  planning,  and  (4)  execution. 

In  the  detection  and  monitoring  stage,  the  individual  seeks  out  information  that  is  relevant  to  the 
task,  such  as  reading  gauges,  or  receives  it  from  signals  and  cues  in  the  environment  that  draw 
attention  to  salient  information,  such  as  alarms  activating.  The  information  that  is  sought  is 
determined  by  the  individual’s  knowledge  of  what  information  is  needed  or  by  procedures  and 
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other  task  demands.  The  signals  and  cues  provided  by  the  environment  may  be  relevant  to  the 
task,  such  as  alarms,  or  irrelevant,  such  as  a  thunderclap. 

Numerous  errors  are  possible  at  this  first  processing  stage.  For  example,  an  individual  may  only 
seek  some  information  and  ignore  other  relevant  information.  Or,  the  worker  may  be  distracted 
and  fail  to  monitor  important  indications.  Or,  there  may  be  too  many  signals  received  from  the 
environment  at  one  time  and  the  individual  misses  important  information. 

In  the  situation  assessment  stage,  the  individual  uses  the  information  gathered  from  detection  and 
monitoring  and  his  or  her  knowledge  to  develop  a  coherent  explanation  of  the  information 
received.  This  explanation  is  formed  into  a  mental  representation  of  plant  state,  in  the  case  of 
operators,  or  equipment  status,  for  maintenance  or  instrumentation  and  control  technicians.  This 
mental  representation  is  used  to  generate  expectations  about  other  plant  or  equipment 
parameters,  expectations  about  future  consequences,  and  explanations  of  what  has  been 
observed,  as  well  as  to  identify  unusual  conditions  and  anticipate  potential  problems. 

Errors  during  the  situation  assessment  stage  arise  due  to  inaccuracies  in  the  mental  representation 
that  is  formed.  For  example,  the  representation  may  be  incomplete,  if  relevant  information  was 
not  detected  during  the  initial  stage.  Or,  the  information  received  may  be  interpreted  incorrectly. 
Or,  the  knowledge  that  is  incorporated  into  the  representation  may  be  incomplete  or  inaccurate. 

In  some  cases,  a  situation  may  be  too  complex  for  an  operator  to  be  able  to  form  an  accurate 
mental  representation. 

In  the  response  planning  stage,  the  individual  chooses  a  course  of  action  based  upon  the  situation 
assessment.  Response  planning  involves  establishing  goals,  generating  an  action  plan, 
monitoring  the  effectiveness  of  the  plan  in  achieving  the  goals,  filling  in  gaps  in  the  plan  and 
adapting  it  as  the  situation  changes  or  feedback  is  received  on  its  effectiveness. 

Errors  may  also  occur  during  any  of  the  response-planning  activities.  For  example,  the  goals  that 
are  established  may  be  incorrect  because  the  situation  assessment  was  inaccurate.  The  procedure 
selected  for  use  may  be  the  wrong  one  for  the  situation.  Or,  unexpected  events  may  occur  that 
are  not  detected,  so  the  plan  is  not  corrected. 

Finally,  in  the  execution  phase,  plans  are  implemented  to  achieve  the  task  goals.  Plan  execution 
will  typically  require  prioritization  of  actions,  and  the  allocation  of  personnel  resources  and 
coordination,  whenever  more  than  one  individual  is  involved  in  the  task.  During  the  execution 
phase,  the  achievement  of  subgoals  is  monitored  and  adjustments  may  be  required. 

Errors  also  occur  during  plan  execution.  For  example,  an  individual  may  forget  to  take  a 
required  action  or  fail  to  detect  and  correct  an  error  that  is  made. 

A  key  contributor  to  information-processing  errors  is  the  limited  capacity  of  working  memory. 
Long-term  memory,  where  knowledge  is  stored,  is  virtually  unlimited.  But  research  has  shown 
that  working  memory  can  hold  and  manipulate  only  about  seven  items  at  one  time.  As  a  result, 
information  that  exceeds  working  memory  capacity  may  be  displaced  or  lost. 
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Another  contributor  to  information-processing  errors  is  habit.  When  a  behavior  has  been 
practiced  or  executed  many  times,  it  becomes  automatic.  That  is,  the  need  to  pay  attention  to 
executing  the  behavior  and  to  exert  conscious  control  over  actions  is  reduced.  The  benefit  of 
habits  is  that  they  reduce  the  burden  on  working  memory.  The  disadvantage  is  that  a  habit  may 
intrude  on  performing  a  new  or  different  task  where  the  habitual  behavior  is  unwanted. 

10.1.2  Motivation 

Work  motivation  has  been  defined  as  “the  conditions  responsible  for  variations  in  the  intensity, 
quality,  and  direction  of  ongoing  behavior."  Intensity  refers  to  how  hard  personnel  work  and 
how  productively  work  hours  are  used.  Quality  refers  to  both  the  manner  in  which  work  is 
performed  (e.g.,  safely,  conscientiously)  and  the  extent  to  which  work  products  meet 
expectations.  The  direction  of  work  behavior  is  determined  by  the  values,  needs  and 
expectations  that  personnel  bring  to  the  job  and  the  individual’s  interpretation  of  the 
organization’s  values,  reward  structures  and  the  goals  that  are  communicated. 

Personnel  generally  require  more  than  a  paycheck  from  their  jobs  to  sustain  motivation.  Other 
job  characteristics,  such  as  opportunities  to  maintain  and  enhance  self-esteem,  to  meet  social 
needs  and  to  grow  professionally,  have  also  been  shown  to  be  important.  In  fact,  the  highest 
levels  of  work  motivation  are  found  when  the  organization’s  and  individual’s  values,  needs, 
expectations  and  goals  are  congruent,  so  that  the  organization  fosters  the  individual’s  ability  to 
meet  personal  needs  and  goals  on  the  job. 

It  is  important  to  note,  however,  that  high  levels  of  motivation  do  not  always  translate  into  error- 
free  performance.  There  are  many  prerequisites  that  must  be  met  in  a  work  environment  before 
motivation  has  much  effect.  For  example,  motivation  to  perform  a  task  correctly  is  of  little  value 
without  the  knowledge  of  how  to  do  it.  Motivation  to  perform  work  safely  will  not  ensure  safe 
performance  if  the  potential  risks  associated  with  the  work  activity  and  methods  to  minimize  or 
avoid  them  are  not  known.  Motivation  to  perform  work  in  accordance  with  procedures  will  be 
stymied  if  the  procedures  for  a  task  are  out-of-date,  do  not  apply  to  current  plant  status,  or  cannot 
be  used  in  the  work  environment.  Motivation  to  use  the  required  personal  protective 
equipment  (PPE)  or  tools  and  equipment  for  a  job  will  not  ensure  safe  performance  if  the 
necessary  PPE,  tools  and  equipment  are  not  available.  A  key  issue  for  NRC  inspectors  who  are 
reviewing  an  investigation  in  which  motivation  has  been  cited  as  a  cause,  then,  is  to  rule  out 
other  causes  for  error  that  may  have  made  worker  motivation  irrelevant. 

One  way  in  which  high  levels  of  motivation  may  reduce  errors  is  that  motivated  personnel  may 
be  more  likely  to  take  responsibility  for  bringing  attention  to  any  barriers  to  correct  task 
performance  that  they  encounter  and  to  fixing  those  that  are  within  their  span  of  control.  But,  if 
the  problems  identified  are  not  within  the  workers’  span  of  control  and  are  not  addressed  by  the 
organization,  high  levels  of  motivation  may  also  lead  personnel  to  develop  workarounds  to  get 
work  done  despite  the  barriers.  Or,  motivation  may  be  decreased  and  workers  become 
disaffected,  if  concerns  and  problems  are  repeatedly  raised  but  not  addressed. 

An  important  source  of  motivational  errors  is  in  defining  the  goals  to  be  accomplished  in  task 
performance.  Supervision  plays  a  key  role  in  establishing  and  communicating  the  goals  to  be 
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met  in  a  work  activity.  Section  14  discusses  the  effects  of  supervisory  direction,  oversight  and 
leadership  on  motivation. 

Peers  may  also  influence  motivation.  Crosschecking  may  detect  and  correct  errors  that  occur. 
Peer  group  norms  as  they  apply  to  work  intensity  and  quality  may  also  affect  individual 
motivation.  Behavior-based  safety  programs  include  peer  observation  and  feedback  to  reduce 
unsafe  acts,  although  these  programs  are  controversial  because  of  their  perceived  emphasis  on 
“fixing  the  worker”  rather  than  “fixing  the  work  environment.” 

10.2  DIRECT  CAUSES  OF  ATTENTION  AND  MOTIVATION  ERRORS 

A  direct  cause  of  an  attention  and  motivation  error  describes  the  characteristics  of  a  worker’s 
internal  state  that  caused  or  contributed  to  an  error.  Specific  examples  of  errors  that  may  be  due 
to  attention  and  motivation  are  presented  below. 

10.2.1  Detection  and  Monitoring 

Information  not  detected  -  Task-relevant  information  was  available,  but  it  was  not 
detected.  For  example,  a  conversation  between  an  operator  and  a  security  guard 
distracted  the  operator  on  her  rounds  and  she  failed  to  detect  that  a  pipe  was  leaking. 

Information  discounted  -  Task-relevant  information  was  available,  but  it  was  ignored  or 
interpreted  incorrectly.  For  example,  an  operator  may  mentally  adjust  a  reading  from  an 
instrument  that  typically  reads  high,  when  the  instrument  was  recently  re-calibrated  and 
is  reading  correctly. 

Information  lost  -  Task-relevant  information  was  detected,  but  was  not  recalled  when 
needed.  For  example,  an  operator  may  have  taken  a  reading  on  an  instrument,  but  did  not 
write  it  down,  and  so  did  not  remember  the  earlier  reading  when  he  or  she  checked  it 
again,  and  failed  to  detect  a  trend. 

10.2.2  Situation  Assessment 

Assessment  incomplete  -  Errors  were  committed  because  the  situation  was  assessed 
incompletely  due,  for  example,  to  incomplete  information  or  the  inability  to  interpret  and 
analyze  the  information  available  because  of  time  constraints.  As  a  result,  for  example, 
the  crew  did  not  recognize  that  they  had  entered  a  Limiting  Condition  for  Operation. 

Assessment  inaccurate  -  Errors  were  committed  because  the  situation  assessment  was 
incorrect.  The  information  on  which  the  assessment  was  based  may  have  been 
inaccurate,  for  example,  or  personnel  may  have  misinterpreted  the  information  received. 
Or,  personnel  may  not  have  possessed  the  knowledge  required  to  assess  the  situation 
accurately  (refer  to  Section  9,  Knowledge,  Skills  and  Abilities). 
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10.2.3  Response  Planning 


Plan  incorrect  -  Errors  were  committed  because,  for  example,  the  plan  was  incomplete  or 
could  not  be  implemented  as  intended  under  current  plant  conditions.  For  example, 
workers  assigned  to  a  preventative  maintenance  task  were  unable  to  complete  it  because  a 
control  room  operator  recognized  that  taking  the  component  out  of  service  would  have 
conflicted  with  other  plant  activities. 

Plan  not  modified  -  Errors  occurred  because  circumstances  changed  and  the  plan  was  no 
longer  appropriate  for  the  circumstances.  For  example,  a  construction  task  could  not  be 
completed  when  an  electrical  conduit  that  was  not  on  the  drawings  was  discovered. 

10.2.4  Execution 

Slip  -  An  error  occurred  because  an  unintended  action  was  taken.  For  example,  a 
technician  placed  a  switch  in  the  OFF  position  when  he  had  intended  to  place  it  in 
AUTO. 

Lapse  -  An  error  occurred  because  the  required  action  was  momentarily  lost  from 
working  memory.  As  a  result,  the  action  was  not  performed  or  was  performed 
incorrectly. 

Intrusion  -  An  error  occurred  because  an  overleamed  sequence  of  actions  was  performed 
without  conscious  control  and  the  habit  was  inappropriate  for  the  circumstances.  For 
example,  personnel  risked  exposure  to  hazardous  fumes  when  they  followed  their  usual 
path  to  the  break  room,  which  required  them  to  pass  through  a  locked  door.  When  they 
unlocked  the  door,  the  fumes  reminded  them  that  the  room  they  were  about  to  enter  was 
the  site  of  a  recent  chemical  spill  that  had  not  yet  been  contained. 

10.2.5  Motivation 

Expectations  -  Management  expectations  regarding  productivity,  quality  workmanship 
and  safety  were  not  effectively  communicated  to  personnel  and  examples  of  the  desired 
behaviors  were  not  provided.  As  a  result,  personnel  may  have  been  confused  or 
misinterpreted  expectations  so  that  their  decisions  and  actions  deviated  from  what  was 
desired. 

Reward  structure  -  The  desired  behaviors  with  regard  to  productivity,  quality 
workmanship  and  safety  were  not  appropriately  rewarded.  As  a  result,  individuals’ 
motivation  to  perform  to  expectations  was  decreased,  leading  to  errors. 

Feedback  -  Personnel  did  not  raise  concerns  or  identify  barriers  to  effective  performance 
with  the  result  that  errors  occurred.  Concerns  were  not  raised,  for  example,  due  to  a 
perception  that  nothing  would  be  done  to  correct  the  problems  or  that  personnel  would  be 
punished  for  raising  concerns. 
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Workarounds  -  Concerns  were  raised  and  barriers  to  effective  performance  were 
identified,  but  not  corrected.  As  a  result,  personnel  developed  unauthorized  and 
unanalyzed  work  practices  to  accomplish  tasks  and  the  workarounds  resulted  in  errors. 

Or,  management  authorized  the  workaround  because  a  repair  would  be  too  expensive, 
leading  to  errors. 

Peers  -  Errors  were  committed  because  crosschecking  was  not  performed  or  peer 
influence  adversely  affected  productivity,  quality  workmanship  or  safety  behavior.  For 
example,  a  staff  member  who  consistently  wore  hearing  protection  where  required  was 
ridiculed  by  other  staff  for  doing  so. 

10.3  PROGRAMMATIC  CAUSES  OF  ATTENTION  AND  MOTIVATION  ERRORS 

Many  licensee  programs,  policies  and  practices  are  intended  to  reduce  errors  associated  with 
attention  and  motivation.  Some  programs  directly  focus  on  these  potential  causes  and 
contributors  to  error,  such  as  the  human  factors  engineering  program  at  a  site  or  a 
behavior-based  safety  program.  Others  may  indirectly  affect  attention  and  motivation 
during  task  performance.  Licensee  programs  that  may  be  implicated  in  errors  caused  by 
attention  or  motivation  include: 

Human  Factors  Engineering  -  Weaknesses  in  the  design  of  human-system  interfaces,  for 
example,  may  make  it  difficult  for  personnel  to  detect  changes  in  important  parameters  or 
to  interpret  the  information  displayed  correctly.  Difficult-to-use  human-system  interfaces 
also  may  frustrate  personnel  and  inadvertently  communicate  a  management  message  that 
accurate,  timely  human  performance  is  not  important. 

Procedures  -  Accurate,  accessible  and  usable  procedures  also  play  an  important  role  in 
directing  attention,  assisting  in  the  development  of  an  accurate  situation  assessment  and 
in  developing  and  executing  response  plans.  For  example,  the  entry  conditions  to 
operating  procedures  assist  personnel  to  assess  the  situation  accurately.  If  entry 
conditions  and  prerequisites  are  not  provided,  personnel  are  more  likely  to  miss  relevant 
information  about  the  situation  and  execute  an  incorrect  response  plan. 

Training  -  Because  knowledge  guides  information  processing  at  every  stage,  weaknesses 
in  the  training  program  may  have  a  key  effect  on  the  likelihood  of  attention-related 
errors.  A  programmatic  weakness  in  ensuring  proficiency  training,  for  example,  may 
prevent  personnel  from  maintaining  mastery  of  the  knowledge  required  to  develop  an 
accurate  situation  assessment  or  develop  effective  response  plans  for  tasks  that  are 
infrequently  performed. 

Human  Resources  -  Personnel  selection  processes  play  a  role  in  ensuring  that  staff  is 
qualified  (i.e.,  possess  the  KSAs  required  for  the  job).  Weaknesses  in  the  personnel  job 
performance  evaluation  and  reward  systems  also  may  fail  to  communicate  management 
expectations  or  may  reward  behavior  that  does  not  meets  those  expectations.  If 
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disciplinary  actions  are  not  perceived  as  being  administered  lawfully  and  fairly,  employee 
motivation  to  work  productively  and  safely  may  be  reduced. 

Supervision  -  Supervision  communicates  and  reinforces  management  expectations  and 
establishes  goals  and  requirements  for  task  performance.  Supervisory  oversight  may 
increase  motivation  to  perform  in  accordance  with  expectations  as  well  as  detect  and 
correct  any  errors  that  occur.  Weaknesses  in  supervision,  for  example,  may  cause  staff  to 
choose  production  over  safety  goals  in  their  work  or  to  tolerate  workarounds  that  may 
lead  to  errors. 

Problem  Identification/Resolution  -  Licensee  programs  for  reporting,  documenting  and 
resolving  barriers  to  effective  performance  maintain  staff  motivation  levels  when 
problem  reports  result  in  elimination  or  mitigation  of  the  barriers.  Weaknesses  in  these 
programs  may  not  only  frustrate  personnel,  but  also  encourage  the  development  of 
workarounds  that  may  lead  to  errors. 

Employee  Concerns  -  Employee  concerns  programs  provide  another  avenue  for 
personnel  to  raise  safety  issues.  Weaknesses  in  the  employee  concerns  program  will 
discourage  personnel  from  raising  problems  when  they  fear  adverse  consequences  and 
will  call  stated  management  expectations  into  question,  resulting  in  lower  compliance. 

Behavioral  Safety  -  Behavioral  safety  programs  focus  on  identifying  and  correcting  work 
behaviors  that  may  result  in  adverse  consequences  through  behavioral  observation  and 
feedback  from  supervisors  and  peers.  Some  programs  also  emphasize  self-checking, 
such  as  the  Institute  for  Nuclear  Power  Operations’  STAR  program  (stop-think-act- 
review).  Focusing  on  potentially  unsafe  acts  appears  to  improve  human  performance  at 
some  sites. 

10.4  ADDITIONAL  RESOURCES  ON  ATTENTION  AND  MOTIVATION 

•  U.S.  Code  of  Federal  Regulations,  Part  19.20,  Employee  protection,  Title  10,  Energy 
(revised  periodically).  Washington,  DC:  U.S.  Government  Printing  Office. 

•  Mumaw,  R.J.  (1994).  The  effects  of  stress  on  nuclear  power  plant  operational  decision 
making  and  training  approaches  to  reduce  stress  effects  (NUREG/CR-6127). 
Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  Mumaw,  R.,  Swatzler,  D.,  Roth,  E.  and  Thomas,  W.  (1994).  Cognitive  Skill  Training  for 
Nuclear  Power  Plant  Operational  Decision  Making  (NUREG/CR-6126).  Washington, 
D.C.:  U.S.  Nuclear  Regulatory  Commission. 

•  Roth,  E.,  Mumaw,  R.  and  Lewis,  P.  (1994).  An  Empirical  Investigation  of  Operator 
Performance  in  Cognitively  Demanding  Simulated  Emergencies  (NUREG/CR-6208). 
Washington,  D.C.:  U.S.  Nuclear  Regulatory  Commission. 
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•  Woods,  D.,  Pople,  H.E.  and  Roth,  E.M.  (1990).  The  Cognitive  Environment  Simulation 
as  a  Tool  for  Modeling  Human  Performance  and  Reliability  (NUREG/CR-5213,  Vols.  1 
and  2).  Washington  DC:  U.S.  Nuclear  Regulatory  Commission. 
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11  PROCEDURES 


11.1  PROCEDURE-RELATED  ERRORS  AND  THEIR  CAUSES 

Procedures  are  instructions  for  performing  a  task.  The  instructions  may  be  provided  in  formal 
written  procedures  or  as  hand-written  information  included  in  a  work  package.  Procedure- 
related  errors  are  errors  that  occur  because  some  characteristic  of  the  procedure  caused  task 
performance  to  fail. 

The  primary  purpose  of  procedures  is  to  ensure  that  tasks  are  performed  correctly.  Procedures 
also  can  document  the  best  way  to  perform  a  task,  so  work  is  performed  more  efficiently. 
Procedures  may  also  serve  a  record-keeping  function  to  document  when  and  how  a  task  was 
performed. 

Procedures  reduce  the  likelihood  of  human  errors  under  several  conditions.  When  a  task  is 
complex  or  performed  infrequently,  even  the  most  experienced  workers  may  forget  the  steps 
required  or  the  order  in  which  certain  steps  must  be  performed.  Procedures  can  also  fill  gaps  in  a 
worker’s  knowledge  about  a  task,  component  or  system.  Procedures  are  particularly  helpful 
when  plant  systems  are  in  an  unusual  configuration  and  routine  actions  that  may  normally  be 
performed  without  a  procedure  can  result  in  adverse  consequences. 

For  procedures  to  be  effective  in  ensuring  that  tasks  are  performed  correctly,  they  must  be  used. 
There  are  a  number  of  reasons  that  workers  may  not  use  procedures: 

•  Procedures  are  inaccurate 

•  Procedures  are  out  of  date 

•  No  procedure  has  been  written  for  the  task 

•  Users  cannot  find  the  procedure  they  want  to  use 

•  Users  don’t  need  a  procedure  because  the  task  is  simple 

•  Users  need  more  information  than  the  procedures  contain 

•  Users  see  procedures  as  an  affront  to  their  skill 

•  Procedures  are  difficult  to  use  in  the  work  environment 

•  Procedures  are  difficult  to  understand. 

It  is  important  to  note  that  using  a  procedure  introduces  an  additional  task  to  the  work  being 
performed.  Using  a  procedure  in  a  step-by-step  manner,  and  checking  off  each  step  as  it  is 
performed,  may  ensure  that  tasks  are  performed  deliberately  and  correctly.  However,  there 
are  many  circumstances  in  a  plant  in  which  the  physical  demands  of  using  a  procedure  in 
this  way  complicates  the  job  and  can  contribute  to  the  likelihood  of  errors  rather  than 
reducing  them.  Using  a  procedure  also  increases  mental  demands  by  requiring  that  the  users 
read  the  procedure,  comprehend  it  and  then  act  on  what  they  have  understood.  When  this 
read-comprehend-act  loop  is  added  to  the  primary  tasks  that  operators  must  perform  during 
upset  conditions  (e.g.,  monitoring  and  detection,  situation  assessment,  response  planning  and 
response  implementation),  it  is  particularly  important  that  the  procedures  are  easy  to 
understand  and  use. 
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The  list  of  reasons  for  not  using  procedures  also  points  out  some  of  the  ways  in  which  errors 
can  occur  when  they  are  used.  For  example,  if  a  procedure  contains  inaccurate  instructions 
or  a  drawing  is  out-of-date  because  a  system  or  component  has  been  modified  since  the 
document  was  written,  personnel  who  use  the  procedure  may  take  incorrect  actions.  Or,  if  a 
procedure  step  is  written  in  an  ambiguous  and  confusing  manner,  workers  may  try  to  follow 
it,  but  take  incorrect  actions  because  they  misinterpret  a  step. 

Human  performance  problems  are  often  erroneously  attributed  to  procedures  or  a  failure  to 
follow  procedures.  Procedures  are  frequently  identified  as  a  cause  for  human  performance 
problems  because  they  describe  the  standards  and  requirements  for  task  performance,  and 
when  task  performance  fails,  there  is  likely  some  procedure  or  policy  that  appears  to  have 
been  violated.  It  may  not  be  the  case,  however,  that  an  attribute  of  the  procedure,  or  the  lack 
of  a  procedure,  or  the  failure  to  use  a  procedure  or  reference  document  caused  the  error. 

Rather,  what  appears  to  be  a  failure  to  follow  the  procedure  may  be  a  symptom  of  another 
underlying  cause,  such  as  a  training  need  or  inadequate  labeling,  rather  than  the  result  of  the 
procedure’s  characteristics.  It  is  important,  therefore,  that  the  licensee  provides  evidence 
linking  the  human  error  specifically  to  characteristics  of  the  document  or  weaknesses  in  how 
it  was  used  when  identifying  a  procedure-related  error. 

1 1.2  DIRECT  CAUSES  OF  PROCEDURE-RELATED  ERRORS 

A  direct  cause  of  a  procedure-related  error  describes  characteristics  of  the  procedures  that  caused 
task  performance  to  fail  or  how  the  procedure  was  used  or  not  used  that  caused  task  performance 
to  fail.  There  are  a  number  of  ways  in  which  procedures  may  cause,  contribute  to  or  fail  to 
prevent  an  error.  These  include: 

11.2.1  No  Procedure  Used 

No  procedure  -  Task  performance  failed  because  no  procedure  was  written  for  the  task 
and  the  workers’  reliance  on  memory  or  “skill  of  the  craft”  resulted  in,  for  example, 
forgetting  important  steps,  performing  steps  out  of  sequence  or  taking  incorrect  actions. 

Procedure  not  available  -  A  procedure  for  the  task  existed,  but  was  not  used  and  should 
have  been.  For  example,  a  procedure  may  not  be  available  for  a  task  because  it  was  not 
included  in  the  work  package  or  the  workers  were  not  aware  that  the  document  existed 
and  so  did  not  find  and  use  it. 

Procedure  inconvenient  to  use  -  Task  performance  failed  because  using  a  procedure  was 
difficult  in  the  work  environment.  For  example,  procedure  use  may  be  inconvenient  in 
confined  spaces,  in  contamination  zones  or  when  wearing  protective  equipment. 

Procedure  too  difficult  to  use  -  Task  performance  failed  because  workers  considered  the 
procedure  too  difficult  to  use  and  so  did  not  use  it.  For  example,  workers  may  avoid 
using  procedures  that  are  written  in  excessive  detail  or  that  include  what  they  consider  to 
be  unnecessary  steps  that  interfere  with  performing  the  task.  Or,  a  procedure  may  be 
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written  with  too  little  detail  for  the  knowledge  levels  of  the  workers,  so  that  they  do  not 
understand  the  procedure  or  misinterpret  it. 

Procedure  use  not  required  -  Task  performance  failed  because  an  existing  procedure  was 
not  used.  For  example,  licensee  policy  may  have  required  that  the  procedure  be  reviewed 
before  use  or  that  it  be  available  at  the  work  site,  but  did  not  require  that  the  procedure  be 
in-hand  and  followed  step-by-step  during  task  performance. 

11.2.2  Wrong  Procedure  Used 

Wrong  unit,  train,  component  -  Task  performance  failed  because  the  procedure  was  not 
intended  for  use  with  the  equipment  that  was  being  operated  or  maintained.  The  wrong 
procedure  may  be  included  in  the  work  package  or  workers  may  select  the  wrong 
document  for  use.  Or,  a  procedure  may  not  clearly  indicate  the  equipment  to  which  it 
applies.  In  some  cases,  the  wrong  procedure  may  be  used  because  labeling  is  deficient 
and  the  workers  cannot  verify  that  the  procedure  applies. 

Wrong  revision  -  Task  performance  failed  because  the  most  recent  revision  to  the 
procedure  was  not  used.  If  modifications  were  made  to  equipment,  but  the  affected 
documents  were  not  updated,  incorrect  instructions  in  the  procedure  may  cause  an  error. 
Or,  workers  may  inadvertently  access  and  use  an  earlier  revision. 

Wrong  procedure  for  plant/equipment  state  -  Task  performance  failed  because 
prerequisites  for  using  the  procedure  were  not  met  by  current  equipment  or  system 
configuration. 

11.2.3  Procedure  Used,  But  Wrong  or  Incomplete 

Typographical  error  -  An  error  was  made  because  information  presented  in  the  procedure 
was  incorrect  due  to  a  typographical  error.  For  example,  the  numbers  or  letters  in 
equipment  identifiers,  such  as  valve  names,  or  required  values  for  instrument  readings 
may  be  transposed  or  incomplete. 

Facts  incorrect  -  Task  performance  failed  because  the  instructions  or  the  information 
presented  in  procedure  steps  was  incorrect.  For  example,  the  procedure  may  include 
improper  set  points  or  describe  actions  that  cannot  be  taken  under  normal  conditions  of 
use. 


Incomplete  -  Task  performance  failed  because  facts  or  useful  information  were  omitted 
from  the  procedure.  For  example,  the  procedure  writer  may  have  assumed  that  workers 
would  know  the  steps  required  to  prepare  for  conducting  a  maintenance  activity  and  so 
did  not  include  them  in  the  procedure.  Or,  important  cautionary  information  about  how 
to  perform  a  step  was  not  included  in  the  procedure. 

Sequence  wrong  -  Task  performance  failed  because  the  sequence  in  which  the  steps  were 
presented  in  the  procedure  was  incorrect. 
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Second  checker  needed,  but  absent  -  Task  performance  failed  because  the  task  was 
important  enough  to  warrant  independent  verification  that  the  objective  of  a  task  or  series 
of  actions  was  achieved,  but  verification  was  not  required.  As  a  result,  errors  were 
committed  during  task  performance,  but  not  detected  and  corrected. 

No  placekeeping  -  Task  performance  failed  because  the  procedure  did  not  provide  a 
method  for  placekeeping.  Sign-off  spaces  next  to  critical  steps  or  other  methods  for 
assisting  the  user  to  track  progress  through  the  procedure  were  not  used.  Omitting  a 
procedure  step  is  the  most  common  consequence  of  not  providing  placekeeping  aids. 

11.2.4  Procedure  Used,  But  Followed  Incorrectly 

Format  confusing  -  The  layout  of  procedure  elements  on  the  page  was  confusing  to 
workers.  For  example,  cautions  or  notes  were  not  separated  from  action  steps  and 
highlighted  with  distinctive  formatting.  Or,  the  relationship  of  steps  to  substeps  or  lists 
was  unclear  because  no  indenting  was  used. 

Content  confusing  -  The  information  presented  in  the  procedure  or  reference  document 
was  confusing  to  workers.  For  example,  the  abbreviations  or  acronyms  used  were 
unfamiliar  to  the  users.  Or,  short,  simple  action  steps  in  the  imperative  voice  were  not 
used.  Conditional  statements  (i.e.,  logic  steps  used  to  present  decision  points  in 
procedures)  can  be  particularly  confusing  if  formal  Boolean  logic  statements  are  not 
used.  Cross-references  to  other  procedures,  to  reference  documents  or  to  other  steps 
within  the  same  procedure  may  be  confusing  and  can  cause  workers  to  lose  track  of  the 
sequence  in  which  they  are  to  perform  steps. 

Graphics  confusing  -  Graphics  used  in  the  procedures  were  confusing  to  workers.  Tables 
or  figures  were  difficult  to  read  and  understand.  Or,  too  many  emphasis  techniques  were 
used  in  the  procedure  text  so  that  unimportant  information  was  highlighted,  while 
important  information  was  not. 

11.3  PROGRAMMATIC  CAUSES  OF  PROCEDURE-RELATED  ERRORS 

Programmatic  causes  of  procedure-related  errors  are  typically  found  in  the  licensee’s 
processes  for  managing  the  development,  use  and  control  of  procedures.  A  number  of  good 
practices  have  been  identified  to  assure  that  procedures  will  be  effective  in  preventing 
errors,  many  of  which  are  documented  in  NRC  guidance  for  emergency  operating 
procedures  programs.  Other  programs  may  also  contribute  to  procedure-related  errors. 

11.3.1  Procedures  Program 

The  following  weaknesses  in  procedures  programs  have  been  shown  to  result  in  ineffective 
procedures: 

Multidisciplinary  team  not  used  -  Development  of  technically  accurate  and  usable 
procedures  is  enhanced  by  the  involvement  of  a  multidisciplinary  team.  Procedure 
development  teams  should  include  specially  trained  procedure  writers  working  with 


11-4 


subject  matter  experts,  such  as  a  representative  of  the  intended  users  and  engineers  with 
specific  expertise  regarding  the  equipment  to  be  operated  or  maintained.  A  single 
procedure  writer  working  alone  may  miss  important  technical  information,  may  use 
terminology  that  is  unfamiliar  to  the  intended  users,  or  sequence  the  procedure  steps 
inefficiently.  As  a  result,  the  procedure  may  be  inaccurate  or  difficult  to  comprehend, 
increasing  the  likelihood  of  errors. 

Writer’s  guide  -  Writers’  guides  provide  information  to  procedure  writers  regarding 
techniques  for  formatting  procedures,  presenting  different  types  of  content  (e.g.,  action 
and  decision  steps)  and  for  developing  usable  graphics.  If  a  writer’s  guide  is  not 
followed  or  it  is  incomplete,  the  resulting  procedures  may  be  difficult  to  comprehend 
and  follow. 

Verification  -  Procedure  verification  is  a  process  that  provides  a  final  check  on  the 
technical  accuracy  of  the  procedure  steps  and  on  the  procedure’s  compliance  with 
writers’ guide  requirements.  In  most  plants,  an  individual  who  was  not  involved  in 
authoring  the  procedure  typically  verifies  that  the  procedure  correctly  incorporates 
information  from  the  technical  basis  documents  and  meets  the  writer’s  guide 
requirements.  Verification  may  also  involve  walking  down  the  procedure  at  the  work 
site  to  ensure  that  equipment  identifiers  in  the  procedure  match  the  labels  and  tags  on  the 
equipment,  that  the  procedure  can  be  used  under  the  expected  conditions  at  the  work 
site,  that  the  steps  are  sequenced  correctly  and  efficiently  considering  the  layout  of  the 
worksite,  and  that  the  tools  list  is  complete.  Procedures  that  have  not  been  verified  are 
often  incomplete,  inaccurate  and  difficult  to  use. 

Validation  -  Procedure  validation  is  a  process  to  check  that  the  procedure  can  be  used  as 
written.  Validation  exercises  in  a  control  room  simulator  with  crews  of  operators  may 
be  used  to  validate  operating  procedures.  Maintenance  simulators  or  mock-ups  may  be 
used  to  validate  maintenance  procedures.  Procedures  that  have  not  been  validated  may 
result  in  unintended  consequences  or  may  not  be  usable  under  actual  work  conditions. 

Review  and  approval  -  The  procedure  review  and  approval  process  ensures  that 
personnel  in  all  other  departments  whose  work  may  be  affected  by  the  procedure  have 
the  opportunity  to  review  it  to  assure  that  activities  in  their  departments  are  not  adversely 
affected.  Review  and  approval  should  also  assure  that  any  other  procedures  affected  by 
the  procedure  are  identified  and  modified,  if  necessary.  Out-dated  cross-references 
between  procedures  are  a  common  source  of  error.  Management  reviews  of  procedures 
or  procedure  revisions  will  ensure  that  the  procedure  is  consistent  with  management 
goals  and  policies. 

Procedure  revisions  -  The  procedure  program  should  include  a  process  for  reviewing  and 
revising  procedures  when  changes  occur  at  the  plant  that  may  affect  the  technical 
accuracy  or  usability  of  the  procedures.  For  example,  if  plant  equipment  is  modified,  the 
procedures  and  drawings  that  apply  to  the  equipment  may  require  revision.  Or,  if  the 
knowledge  and  skills  of  the  workforce  change  due  to  new  hires,  layoffs,  an  aging  and 
retiring  workforce,  then  the  level  of  detail  in  the  procedures  may  need  to  be  increased  to 


11-5 


better  accommodate  the  new  users.  Changes  in  management  goals  and  policies  may  also 
require  procedures  to  be  revised  to  ensure  they  are  consistent  with  new  directives.  And, 
if  other  documents  change  that  are  referenced  in  the  procedure,  the  procedure  should  be 
reviewed  to  determine  whether  any  revisions  are  required. 

11.3.2  Other  Programmatic  Weaknesses 

Training  -  Coordination  between  the  training  and  procedures  programs  is  necessary  to 
ensure  that  user  training  needs  are  assessed  for  a  new  or  revised  procedure.  Changes  to 
existing  training  may  be  necessary  to  ensure  that  the  users  are,  at  a  minimum,  familiar 
with  the  new  or  revised  procedure  and  are  qualified  to  use  it  before  the  procedure  is 
implemented.  Weaknesses  in  training  on  a  new  or  revised  procedure  may 

Operating  Experience  -  Lessons  learned  from  users’  experiences  with  the  procedures  is 
necessary  to  ensure  that  any  problems  or  limitations  in  procedures  are  detected  and 
corrected.  If  operating  experience  does  not  lead  to  timely  procedure  revisions,  personnel 
may  avoid  using  the  procedures  or  develop  workarounds. 

Information  Management  -  Technically  accurate  procedures  depend  on  the  availability 
of  up-to-date  reference  documents,  such  as  vendor  manuals,  engineering  analyses,  and 
drawings.  If  the  reference  documents  used  to  develop  procedures  are  incomplete  or 
contain  errors,  those  omissions  and  errors  may  be  translated  into  the  procedures.  A 
document  control  process  is  also  necessary  to  ensure  that  workers  have  access  to  a 
complete  and  the  most  recent  revision  of  the  procedure. 

Maintenance  -  Procedures  are  written  on  the  basis  of  assumptions  about  the  operability 
and  condition  of  the  equipment  to  which  they  apply.  If  the  equipment  has  not  been 
maintained  and  is  inoperable  or  in  a  degraded  condition,  errors  may  occur  if  the 
procedure  is  not  revised  to  reflect  actual  equipment  conditions. 

11.4  ADDITIONAL  RESOURCES  ON  PROCEDURES 

•  U.S.  Code  of  Federal  Regulations,  Appendix  B  to  Part  50,  Quality  assurance  criteria  for 
nuclear  power  plants  and  fuel  reprocessing  plants.  Criterion  V,  Instructions,  procedures 
and  drawings.  Title  10,  Energy  (revised  periodically).  Washington,  DC:  U.S. 
Government  Printing  Office. 

•  U.S.  Nuclear  Regulatory  Commission  (1978).  Quality  assurance  program  requirements 
( Operation )  (Regulatory  Guide  1.33,  Rev.  2).  Washington,  DC:  U.S.  Nuclear 
Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1982).  Guidelines  for  the  preparation  of 
emergency  operating  procedures  (NUREG-0899).  Washington,  DC:  U.S.  Nuclear 
Regulatory  Commission. 
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•  U.S.  Nuclear  Regulatory  Commission  (1989).  Lessons  learned  from  the  special 
inspection  program  for  emergency  operating  procedures  (NUREG-1358).  Washington, 
DC:  U.S.  Nuclear  Regulatory  Commission. 

•  O’Hara,  J.M.,  Higgins,  J.C.,  Stubler,  W.F.  and  Kramer,  J.  (2000).  Computer-based 
procedure  systems:  Technical  basis  and  human  factors  review  guidance  (NUREG/CR- 
6634).  Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  Barnes,  V.E.,  Moore,  C.J.  Wieringa,  D.R.,  Isakson,  C.S.,  Kono,  B.K.  and  Gruel,  R.L. 
(1989).  Techniques  for  preparing  flowchart-format  emergency  operating  procedures: 
Vol.s  1  and  2  (NUREG/CR-5228,  PNL-6653,  BHARC-700/88/017).  Washington,  DC: 
U.S.  Nuclear  Regulatory  Commission. 

•  Morgenstem,  M.,  Barnes,  V.,  McGuire,  M.,  Radford,  L.  and  Wheeler,  W.  (1985) 
Operating  procedures  in  nuclear  power  plants:  Practices  and  problems 
(NUREG/CR-3968,  PNL-5648).  Washington,  DC:  U.S.  Nuclear  Regulatory 
Commission. 

•  Morgenstem,  M.,  Barnes,  V.,  Radford,  L.,  Wheeler,  W7.  and  Badalamente,  R.  (1984).  The 
development,  use  and  control  of  maintenance  procedures  in  nuclear  power  plants: 
Problems  and  recommendations  (NUREG/CR-3817,  PNL-5121).  Washington,  DC:  U.S. 
Nuclear  Regulatory  Commission. 
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12  TOOLS  AND  EQUIPMENT 


12.1  EFFECTS  OF  TOOLS  AND  EQUIPMENT  ON  HUMAN  PERFORMANCE 

The  design  and  use  of  tools,  equipment  and  personal  protective  equipment  (PPE)  in  the 
workplace  are  typically  considered  industrial  safety  and  health  issues.  But,  tools,  equipment  or 
PPE  may  impact  risk  if  they  cause  or  allow  personnel  to  make  errors  that  may  affect  safety 
systems. 

12.1.1  Tool  Design  and  Use 

Tool  use  is  often  necessary  for  work  activities  at  licensee  sites.  Numerous  checklists  containing 
evaluation  criteria  for  tools  have  been  published  as  a  result  of  increased  public  concern  over 
workplace  injuries,  particularly  those  resulting  from  repetitive  motion  (e.g.,  carpal  tunnel 
syndrome).  In  general,  any  tool  characteristic  that  increases  the  risk  of  worker  injuries  will  also 
increase  the  risk  of  errors  during  task  performance. 

The  proper  tools  for  a  task  depend  upon  the  characteristics  of  the  workplace,  the  individual 
workers  and  the  task  demands.  For  example,  in  confined  areas,  tools  must  be  small  enough  to  be 
usable  in  the  workspace  available  while  retaining  their  functionality.  Errors  may  result  if  tools 
do  not  fit  a  user’s  hand  size  or  handedness  (i.e.,  use  of  a  right-handed  tool  by  a  left-handed 
worker),  skill  levels  or  strength.  Errors  are  also  more  likely  if  the  task  requires  the  use  of  force 
or  repetitive  motion  in  using  the  tool. 

Poorly  designed  tools,  tools  that  are  inappropriate  for  the  workplace,  worker  or  task,  or  tools  that 
are  not  maintained  may  affect  human  performance  in  several  ways.  The  primary  effect  of  poorly 
designed  tools  is  on  motor  performance.  Poorly  designed  tools  may  be  dropped,  cause  physical 
slips  and  erroneous  actions,  or  lead  to  fatigued  or  injured  muscles  that  are  more  difficult  to 
control.  Some  tools  may  interfere  with  visibility  or  increase  discomfort  and  cause  workers  to 
rush  through  jobs.  Tools  that  are  not  maintained  will  not  function  as  intended  and  may  cause 
errors  when  they  are  used. 

12.1.2  Equipment 

The  use  of  various  types  of  equipment  and  machinery  necessary  to  perform  some  work  activities 
may  also  cause  or  contribute  to  errors.  Equipment  may  be  temporary  or  permanently  staged  at  a 
worksite.  Ladders,  scaffolds  or  lifts  may  be  used  for  aboveground  work.  Cranes,  trucks, 
forklifts,  loaders,  or  robots,  for  example,  may  be  brought  to  a  worksite  for  some  tasks.  Some 
tasks  require  the  temporary  deployment  of  additional  lighting,  parts,  and  the  electrical  cabling  to 
energize  necessary  machinery.  The  introduction  of  equipment  and  machinery  to  a  worksite  may 
complicate  task  performance  and  represents  a  change.  Equipment  and  machinery  may  also  affect 
task  performance  if  personnel  expect  it  to  be  available  and  it  is  not,  such  as  a  missing  ladder  that 
was  pre-staged  for  emergency  operations  but  was  removed  and  used  for  other  purposes. 

Aboveground  work  is  particularly  hazardous  and  may  have  adverse  effects  on  some  workers. 

For  example,  personnel  may  experience  dizziness,  instability  or  vertigo  when  working  at  heights. 
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These  responses  may  be  intensified  if  the  surface  on  which  they  are  standing  moves.  Work  at 
any  height  also  introduces  the  potential  for  tools  and  other  materials  to  be  dropped,  which  may 
damage  equipment  or  personnel  below,  or  create  foreign  material  issues. 

Extensive  regulations  and  guidance  have  been  published  by  the  Occupational  Safety  and  Health 
Administration  and  other  government  agencies  regarding  the  safe  work  practices  and  design 
characteristics  of  equipment  that  prevent  worker  injuries  and  other  workplace  hazards.  In 
general,  the  practices  and  equipment  designs  necessary  to  prevent  injuries  also  serve  to  prevent 
errors  that  may  impact  safe  operations. 

12.1.3  Personal  Protective  Equipment 

Personal  protective  equipment  is  necessary  to  perform  many  tasks  at  licensee  sites.  Depending 
upon  the  type  of  hazard  to  which  workers  may  be  exposed,  PPE  may  include  eye,  hand,  ear  and 
foot  protection,  aprons  or  full  suits,  such  as  anti-contamination  clothing.  Protection  from  heat 
stress  and  cold  may  be  necessary  at  times,  as  well  as  respiratory  protection  or  protection  from 
open  flames  for  hot  work.  Aboveground  work  may  require  safety  harnesses. 

The  design  and  use  of  PPE  may  cause  or  contribute  to  errors  in  several  ways.  The  most 
important  concerns  are  that  PPE  may  reduce  sensory  input,  limit  feedback  and  impair  motor 
capabilities.  For  example,  darkly  tinted  safety  glasses  may  hinder  vision  if  used  indoors.  Gloves 
reduce  fine  motor  control.  Hearing  protection  may  prevent  personnel  from  hearing  alarms  or 
verbal  communications.  Personnel  may  become  entangled  in  fall  protection  gear.  Some  forms 
of  protective  clothing  may  contribute  to  heat  stress,  which  may  affect  both  cognitive  and  motor 
functioning,  leading  to  errors.  Combinations  of  PPE  may  interact  and  interfere  with 
performance.  Wearing  PPE  is  also  often  uncomfortable  and  may  distract  workers  or  cause  them 
to  hurry  through  tasks,  increasing  the  potential  for  errors. 

Personal  protective  equipment  that  is  not  maintained  properly  may  also  lead  to  errors.  For 
example,  safety  glasses  and  face  shields  that  have  become  scratched  distort  or  interfere  with 
vision.  In  general,  the  use  of  PPE  is  the  least  preferred  alternative  for  protecting  workers 
because  of  the  impacts  on  performance  most  types  of  PPE  will  have. 

12.2  DIRECT  CAUSES  OF  ERRORS  RELATED  TO  TOOLS  AND  EQUIPMENT 

A  direct  cause  of  an  error  related  to  tools  and  equipment  describes  the  characteristics  of  the  tools 
or  equipment  that  caused  task  performance  to  fail.  There  are  a  number  of  ways  in  which  the 
design  and  use  of  tools  and  equipment  may  impair  performance.  Examples  of  these  are 
presented  below. 

12.2.1  Tools 

Tool  mismatched  to  task  environment  -  The  tool  used  for  the  task  was  too  large,  too 
small  or  otherwise  inappropriate  for  the  work  environment.  It  may  have  obscured  the 
parts  or  equipment  on  which  work  was  being  performed,  causing  errors,  or  created 
discomfort. 
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Tool  mismatched  to  worker  -  The  tool  was  too  large,  too  small  or  inappropriate  for  the 
worker’s  physical  characteristics,  such  as  hand-size,  strength  or  agility.  Some  tools 
require  skills  to  be  used.  If  a  worker  has  not  been  trained  to  use  the  tool  or  the  tool  is 
mismatched  to  the  individual's  characteristics,  he  or  she  may  commit  errors  by  using  it 
improperly,  break  equipment  or  become  injured. 

Tool  poorly  designed  -  Poorly  designed  tools  may  increase  discomfort.  Tools  that  are 
uncomfortable  to  use  may  cause  personnel  to  rush  through  a  task  and  commit  errors. 
Tools  that  are  poorly  designed  may  also  impair  motor  control  and  cause  errors,  such  as 
breaking  equipment  or  applying  excessive  torque  on  a  screw. 

Tool  degraded  -  Tools  that  are  not  maintained  may  not  function  as  intended  or  in 
accordance  with  the  workers’  expectations.  Miscalibrated  or  broken  tools  may  cause 
personnel  to  take  incorrect  actions  or  may  damage  other  equipment. 

Correct  tools  not  available  or  used  -  When  special  tools  have  been  designed  for 
performing  a  task,  an  administrative  challenge  is  created  to  ensure  that  they  are  available 
at  the  worksite  when  needed.  If  other  tools  are  substituted  for  the  special  tool,  task 
performance  may  be  delayed  by  the  workaround  or  it  may  not  be  possible  to  accomplish 
the  task  to  specifications. 

12.2.2  Equipment 

Deployment  wrong  -  Errors  occurred  because  the  equipment  or  machinery  was  deployed 
incorrectly.  For  example,  the  ground  underneath  a  ladder  or  scaffolding  was  uneven, 
angled  or  could  not  support  the  weight.  Or,  machinery  was  deployed  too  near  electrical 
power  lines,  possibly  resulting  in  an  electrical,  or  too  near  overhead  obstructions, 
possibly  causing  damage  to  other  equipment  or  injuries  to  personnel. 

Design  or  construction  wrong  -  Errors  occurred  because  the  equipment  or  machinery  was 
poorly  designed  or  constructed.  For  example,  toeboards  were  not  provided  on  platforms 
erected  in  areas  where  dropping  tools  or  material  could  cause  harm.  Or,  the  scaffolding 
materials  used  were  insufficiently  sturdy  for  the  weight  placed  on  them. 

Used  improperly  -  The  equipment  or  machinery  was  used  in  a  manner  for  which  it  was 
not  designed  or  not  authorized.  For  example,  a  load  contained  too  much  weight  or  a 
crane  was  used  to  lift  personnel  without  following  proper  procedures,  increasing  the 
likelihood  of  equipment  damage  or  injuries. 

Not  available  -  Equipment  or  machinery  required  to  perform  a  task  was  not  available 
when  needed.  Errors  may  occur  if  task  performance  is  delayed  while  personnel  search 
for  the  required  equipment  and  if  other  equipment  or  machinery  is  substituted  for  the 
missing  equipment. 
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12.2.3  Personal  Protective  Equipment  (PPE) 

Mismatched  to  task  -  Task  performance  failed  because  the  design  or  use  of  the  PPE  made 
it  more  difficult  than  necessary.  For  example,  work  was  performed  in  a  high  temperature 
environment  with  multiple  layers  of  anti-contamination  clothing  and  other  PPE,  resulting 
in  cognitive  impairment  due  to  heat  stress.  Or,  the  use  of  tinted  safety  glasses  indoors 
impaired  vision  and  prevented  a  worker  from  correctly  reading  a  tag. 

Mismatched  to  worker  -  Task  performance  failed  because  ill-fitting  PPE  caused 
discomfort  and  interfered  with  task  performance.  For  example,  gloves  that  were  too  large 
further  reduced  fine  motor  control  and  tactile  feedback,  leading  to  errors.  Workers  were 
uncomfortable  and  rushed  through  tasks,  with  the  result  that  post-maintenance  testing 
was  not  completed. 

Poorly  designed  -  Task  performance  failed  because  required  PPE  was  poorly  designed 
and  so  was  ineffective,  allowing  workers  to  be  exposed  to  hazards  that  cause  errors.  For 
example,  a  poorly  designed  respirator  may  allow  a  worker  to  be  overcome  by  caustic 
fumes. 

Not  used  -  Task  performance  failed  because  PPE  was  not  used  when  required,  with  the 
result  that  personnel  were  exposed  to  hazards  that  caused  injuries  and  errors.  For 
example,  an  instrumentation  and  control  technician  received  an  electrical  shock,  which 
also  destroyed  some  wiring  in  the  electrical  panel. 

Not  available  -  Task  performance  failed  because  PPE  was  not  available  when  required. 

As  a  result,  personnel  were  unable  to  complete  a  surveillance  timely  and  Technical 
Specifications  were  violated.  Or,  respirators  were  not  readily  available  for  emergency 
use  and  workers  were  unable  to  enter  an  area  to  respond. 

Used  incorrectly  -  Task  performance  failed  because  personnel  used  the  incorrect  PPE  for 
a  task  or  used  PPE  incorrectly.  For  example,  a  worker  allowed  his  safety  glasses  to  slide 
down  the  bridge  of  his  nose  and  spilled  a  caustic  chemical  when  fluid  splashed  into  his 
eyes. 

Degraded  -  Task  performance  failed  because  PPE  was  not  maintained  and  failed  to 
protect  workers  from  hazards.  For  example,  a  degraded  respirator  allowed  an  uptake. 

Combined  -  Task  performance  failed  because  combinations  of  PPE  were  required  for  a 
task  and  interacted  to  interfere  with  performance.  For  example,  safety  glasses  worn 
under  a  face  shield  distorted  vision,  causing  errors. 

12.3  PROGRAMMATIC  CAUSES  FOR  ERRORS  RELATED  TO  TOOLS  AND 
EQUIPMENT 

Programmatic  causes  of  errors  related  to  tools  and  equipment  are  typically  found  in  the 
licensee's  procurement  processes,  and  industrial  hygiene,  radiation  protection  and 


12-4 


maintenance  programs.  Other  programs  may  also  be  implicated.  Common  programmatic 
causes  of  errors  related  to  tools  and  equipment  include: 

Work  Planning  and  Control  -  Work  planning  and  control  processes  may  fail  to  identify  the 
tools  and  equipment  needed  at  the  work  site.  For  example,  working  in  a  high  temperature 
environment  with  multiple  layers  of  anti-contamination  clothing  and  other  PPE,  without 
assuring  adequate  body  cooling  or  personnel  rotation,  may  cause  cognitive  impairment  due  to 
heat  stress. 

Procurement  -  The  licensee’s  procurement  program  ensures  that  the  tools,  equipment  or  PPE 
that  are  required  to  perform  a  work  activity  have  been  purchased  and  meet  specifications. 

For  mobile  equipment  that  may  be  brought  to  the  site,  such  as  cranes,  the  procurement 
program  is  also  typically  responsible  for  ensuring  that  contractor  equipment  meets 
requirements  and  that  contractor  personnel  are  qualified  to  operate  the  equipment. 
Weaknesses  in  the  procurement  program  may  lead  to  the  use  of  inappropriate,  uncomfortable 
or  ineffective  tools,  equipment  or  PPE. 

Industrial  Hygiene  and  Radiation  Protection  -  These  licensee  programs  are  responsible  for 
ensuring  that  the  hazards  associated  with  a  work  activity  have  been  identified,  communicated 
to  the  workers,  and  that  proper  hazard  controls  are  implemented.  These  programs  are  also 
typically  responsible  for  ensuring  that  PPE  is  fitted  to  individual  workers.  Weaknesses  in 
these  programs  may  not  only  result  in  the  unnecessary  exposure  of  workers  to  hazards,  but 
may  also  set  the  stage  for  errors. 

Procedures  -  As  part  of  the  licensee's  procedure  development  process,  the  tools,  equipment 
and  PPE  required  for  a  work  activity  should  be  considered  when  designing  the  procedures 
and  defining  how  they  will  be  used.  For  example,  effective  procedures  are  designed  so  that 
their  use  is  compatible  with  the  use  of  tools,  equipment  and  PPE.  Procedures  that  do  not 
specify  the  tools,  equipment  and  PPE  required  to  perform  a  task  may  cause  delays  or  errors  if 
incorrect  tools  and  equipment  are  used. 

Training  -  Personnel  often  need  specialized  training  to  use  some  types  of  tools,  equipment 
and  PPE.  If  these  training  needs  have  not  been  met,  workers  may  use  incorrect  tools, 
equipment  or  PPE  or  use  them  improperly,  resulting  in  errors. 

Human  Factors  Engineering  -  Requirements  for  special  tools,  equipment  and  PPE 
should  be  considered  whenever  new  equipment  or  systems  are  installed.  As  a  general 
rule,  engineering  controls  for  hazards  are  more  effective  than  PPE.  The  need  for  special 
tools  or  equipment  creates  an  administrative  burden  and  can  often  be  avoided  if  the 
potential  impacts  on  human  performance  are  considered  during  the  design  stage. 

Reducing  the  need  for  special  tools,  equipment  and  PPE  reduces  opportunities  for  delays 
and  errors  in  task  performance. 

Operating  Experience  -  Reviews  of  relevant  operating  experiences  from  the  plant  and  other 
facilities  with  similar  work  activities  may  reveal  problems  associated  with  tools  and 
equipment  as  well  as  solutions  to  those  problems.  Weaknesses  in  the  operating  experience 
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program  may  Personnel  may  have  reported  problems  with  tools  and  equipment  that 
previously  interfered  with  performance,  and  further  issues  may  be  avoided  if  the  problems 
are  corrected. 

Maintenance  -  Maintenance  of  tools,  equipment  and  PPE  is  necessary  to  ensure  that  they  are 
in  working  condition  when  needed.  Inadequate  maintenance  will  allow  tools,  equipment  and 
PPE  to  degrade  so  that  they  are  difficult  to  use,  ineffective  or  cannot  be  used. 

12.4  ADDITIONAL  RESOURCES  ON  TOOLS  AND  EQUIPMENT 

•  U.S.  Nuclear  Regulatory  Commission  (1988).  Memorandum  of  understanding  between 
NRC  and  OSHA  relating  to  NRC-licensed  facilities  (Information  Notice  88-100). 
Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1998).  Potential  for  degradation  of  the 
emergency  core  cooling  system  and  the  containment  spray  system  after  a  loss-of-coolant 
accident  because  of  construction  and  protective  coating  deficiencies  and  foreign  material 
containment  (Generic  Letter  98-04).  Washington,  DC:  U.S.  Nuclear  Regulatory 
Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1999).  Acceptable  programs  for  respiratory 
protection  (Regulatory  Guide  8.15,  Rev.  1).  Washington,  DC:  U.S.  Nuclear  Regulatory 
Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1996).  Human-system  interface  design  review 
guideline  (NUREG-0700,  Rev.  1,  Vol.s  1-3).  Washington,  DC:  U.S.  Nuclear  Regulatory 
Commission. 
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13  STAFFING 


13.1  EFFECTS  OF  STAFFING  ON  HUMAN  PERFORMANCE 

Stalling  is  the  process  of  accessing,  maintaining  and  scheduling  personnel  resources  to 
accomplish  work.  An  adequately  staffed  organization  ensures  that  personnel  are  available  with 
the  proper  qualifications  for  both  planned  and  foreseeable  unplanned  activities.  Staffing  is  a 
dynamic  process  in  which  plant  management  monitors  personnel  performance  to  ensure  that 
overall  organizational  performance  goals  are  met  or  exceeded.  The  result  of  an  effective  staffing 
process  is  a  balance  between  personnel  costs  and  the  achievement  of  broader  organizational 
goals. 

13.1.1  Staffing  Requirements 

The  NRC  has  established  several  regulations  regarding  the  staffing  of  nuclear  power  plants. 

Title  10  CFR  50.54(m)  establishes  the  regulatory  minimum  crew  composition  for  licensed 
operators.  Title  10  CFR  50  Appendix  R  establishes  the  requirements  for  a  Fire  Brigade. 

NUREG  0737,  “Clarification  of  TMI  Action  Plan  Requirements,”  sets  the  requirement  for  a  Shift 
Technical  Advisor  (STA).  Each  licensee  has  further  established  requirements  in  Technical 
Specifications  or  Site  Licensee  Commitments  for  a  minimum  level  of  shift  staffing  as  well  as  a 
general  description  of  the  site  organization.  The  regulatory  requirements  are  often  lower  than  the 
licensee’s  administrative  requirements  for  minimum  shift  staffing  levels. 

NRC  Information  Notices  91-77  (Shift  Staffing  at  Nuclear  Power  Plants)  and  95-48  (Results  of 
Shift  Staffing  Study)  both  stated  in  part: 

"The  number  of  staff  on  each  shift  is  expected  to  be  sufficient  to  accomplish  all  necessary 
actions  to  ensure  a  safe  shutdown  of  the  reactor  following  an  event.  Those  actions 
include  implementing  emergency  operating  procedures,  performing  required 
notifications,  establishing  and  maintaining  communications  with  the  NRC  and  plant 
management,  and  any  additional  duties  assigned  by  the  licensee’s  administrative 
controls....” 

13.1.2  Staffing  Decision-Making 

Personnel  costs  comprise  a  significant  proportion  of  an  organization’s  operating  budget. 
Managing  staff  size  to  manage  costs  is  a  necessity  for  any  business.  There  are  a  number  of 
issues  to  be  addressed  when  staffing  decisions  are  made.  These  include  the  range  of  expertise 
required,  the  number  of  personnel  needed,  and  the  anticipated  workload,  so  that  the  necessary 
staff  and  expertise  are  available  when  needed. 

13.1.2.1  Range  of  Expertise 

Each  organization  requires  the  proper  amount  and  type  of  expertise  to  safely  and  competently 
operate  the  plant  under  a  variety  of  conditions.  The  term  “expertise”  includes  the  attributes  of 


13-1 


talent,  effectiveness,  knowledge,  skills,  abilities  and  experience  necessary  to  operate  and 
maintain  plant  systems,  structures  and  components. 

Organizations  balance  the  costs  of  maintaining  full-time  expertise  on  staff  with  the  probability 
that  the  expertise  can  be  obtained  from  outside  the  organization  when  the  need  arises.  For 
example,  it  may  be  cost-effective  to  hire  three  junior  engineers  in  a  discipline  for  the  same  costs 
as  two  senior  engineers,  if  the  normal  engineering  workload  requires  three  full-time  staff. 
However,  complex  issues  may  occasionally  arise  that  junior  staff  cannot  resolve  effectively.  A 
lack  of  access  to  the  expertise  of  senior  personnel  could  increase  the  workload,  costs,  or  the 
likelihood  of  human  errors  if,  for  example,  a  corrective  action  developed  by  junior  staff  was  not 
the  optimum  approach. 

Another  factor  that  may  impact  access  to  expertise  is  the  aging  workforce  in  the  nuclear  power 
industry.  Many  of  the  individuals  who  were  involved  in  plant  construction  and  start-up  activities 
are  reaching  retirement  age.  As  they  leave  the  workforce,  these  individuals  often  take  with  them 
extensive  and  irretrievable  information  about  the  design,  construction,  operation  and 
maintenance  of  the  specific  systems  and  components  with  which  they  worked  over  the  years. 
Efforts  to  document  their  knowledge  and  extended  turnovers  to  the  junior  staff  may  capture  some 
of  the  knowledge  they  have  accumulated.  It  has  been  the  case  at  times,  however,  that  the 
knowledge  was  simply  lost,  with  the  result  that  errors  have  occurred  as  junior  staff  “leam  the 
ropes.” 

13.1.2.2  Staff  Size 

The  number  of  individuals  who  are  available  to  support  planned  and  unplanned  activities  is  a  key 
staffing  issue.  Organizations  must  ensure  that  adequate  numbers  of  personnel  are  available  to 
accomplish  on-going  work  activities  timely  and  to  address  the  unplanned  activities,  or  plant 
events,  that  may  occur.  On  the  other  hand,  too  many  staff  may  hamper  performance  on  some 
tasks.  Manpower  planning  and  analyses  ensure  that  the  staff  size  supports  human  performance. 

Surges  in  workload,  such  as  outages  at  nuclear  power  plants,  typically  require  staff  augmentation 
as  well  as  longer  work  hours  for  permanent  staff.  The  introduction  of  contractor  personnel  or 
licensee  personnel  from  other  sites  may  increase  the  likelihood  of  errors  due  to  unfamiliarity 
with  the  plant,  its  procedures  and  hardware,  for  example.  Longer  work  hours  have  the  potential 
to  increase  fatigue,  which  also  contributes  to  the  likelihood  of  error. 

A  key  consideration  in  establishing  the  shift  schedule  is  the  staff  size  and  composition  that  would 
be  required  to  respond  to  an  event  during  the  period  in  which  the  Emergency  Response 
Organization  is  recalled.  This  period  generally  lasts  for  the  first  hour  of  the  event  due  to 
activation  and  personnel  transit  time  to  the  site,  especially  on  the  back  shift.  The  occurrence  of 
an  event  typically  involves  a  substantial  increase  in  workload.  Insufficient  staff  to  meet  the 
increased  demands  will  exacerbate  the  stress  naturally  experienced  by  personnel  on-shift  at  the 
time  an  event  occurs  and  increase  the  potential  for  errors,  as  discussed  below. 

Workload  may  also  be  increased  by  organizational  changes.  For  example,  in  order  to  reduce 
costs,  some  organizations  reorganize  and  re-assign  job  responsibilities.  Others  may  implement  a 
local  or  across-the-board  hiring  freeze  and  attractive  early  retirement  packages,  to  reduce  staff 


13-2 


size  through  attrition.  In  the  absence  of  careful  planning  and  workload  analysis,  these  efforts  to 
reduce  personnel  costs  may  result  in  an  increase  in  human  performance  problems.  Morale  may 
suffer  if  personnel  are  “required  to  do  more  with  less”  and  are  unable  to  complete  their  assigned 
work  on  schedule.  Or,  staff  may  feel  constant  pressure  to  “do  more”  and  so  take  shortcuts  or 
rush  through  their  tasks,  leading  to  errors.  Personnel  may  find  themselves  working  longer  hours 
over  the  long-term,  which  may  result  in  increased  fatigue  and  an  increase  in  the  likelihood  of 
errors.  And,  if  the  potential  loss  of  expertise  associated  with  buy-out  packages  for  senior  staff  is 
not  considered,  errors  may  increase  as  junior  staff  members  assume  new  responsibilities. 

Maintaining  a  larger  staff  or  assigning  more  staff  to  a  task  does  not  always  improve  performance. 
Organizations  can  become  “bloated”  and  develop  inefficient,  bureaucratic  work  methods  if  the 
number  of  personnel  available  is  greater  than  the  workload.  In  addition,  the  assignment  of 
multiple  staff  to  a  task  may  increase  task  complexity  by  increasing  the  amount  of  communication 
and  coordination  required  among  personnel.  For  example,  some  maintenance  tasks  may  require 
expertise  in  both  mechanical  and  electrical  maintenance.  If  two  specialists  are  used  to  perform 
the  task,  it  is  likely  that  they  will  need  to  communicate  about  the  work  and  coordinate  their 
activities.  These  ancillary  tasks  of  coordinating  and  communicating  introduce  increased 
opportunities  for  error.  One  individual  who  is  qualified  in  both  specialties  may  be  able  to 
perform  the  task  more  effectively. 

13.1.3  Task  Overload 

The  primary  consequence  of  inadequate  shift  staffing  is  task  overload.  Task  overload  exists 
when  the  number  of  tasks  that  must  be  accomplished  in  a  given  period  of  time  exceeds  the 
available  personnel  resources.  There  are  various  work  management  strategies  for  responding  to 
task  overload  including: 

•  task  prioritization  and  deferral  or  slippage 

•  increasing  the  work  pace 

•  task  delegation. 

These  strategies  may  lead  to  errors  in  some  circumstances.  For  example,  tasks  may  be 
inappropriately  deferred  so  that  systems  or  components  are  unavailable  when  needed.  Increasing 
the  work  pace  may  lead  to  shortcuts  or  errors  due  to  rushing.  Task  delegation  may  result  in  tasks 
being  performed  by  individuals  who  do  not  have  the  expertise  to  perform  them  correctly.  Task 
overload  may  increase  stress,  leading  to  errors. 

13.2  DIRECT  CAUSES  OF  STAFFING-RELATED  ERRORS 

A  direct  cause  of  a  staffing-related  error  describes  the  characteristics  of  staffing  practices  that 
caused  or  contributed  to  the  error.  Examples  of  direct  causes  for  staffing-related  errors  are 
presented  below. 

Expertise  Not  Available  -  The  correct  mix  of  qualified  personnel  was  not  available  on 
staff  to  perform  the  work.  For  example,  a  lack  of  available  expertise  resulted  in  delaying 
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task  performance  until  a  qualified  person  could  be  called  in,  or  the  task  was  assigned  to  a 
less  qualified  person  who  committed  an  error. 

Insufficient  Staff  Available  -  Task  performance  failed  because  adequate  numbers  of 
personnel  were  not  available  to  perform  the  work.  As  a  result,  work  management 
strategies  were  employed  and  the  level  of  stress  increased,  leading  to  errors. 

Too  Many  Staff  -  Task  performance  failed  because  too  many  workers  were  assigned  to 
the  job.  As  a  result,  communication  and  coordination  burdens  were  increased,  which 
increased  the  opportunity  for  errors. 

13.3  PROGRAMMATIC  CAUSES  FOR  STAFFING-RELATED  ERRORS 

Programmatic  causes  of  errors  related  to  staffing  are  typically  found  in  the  licensee's  business 
planning  and  work  scheduling  programs.  Other  programs  may  also  be  implicated.  Common 
programmatic  causes  of  errors  related  to  staffing  include: 

Human  Resources  -  Most  licensees  develop  some  form  of  a  business  plan  that  defines 
organizational  goals  and  objectives.  Business  plans  are  often  used  to  estimate  the 
resources  required  to  achieve  the  goals  and  run  the  business.  Business  plans  may  be  used 
to  determine  staffing  levels  for  the  various  parts  of  the  corporate  organization,  sometimes 
without  manpower  planning  and  analyses  of  anticipated  workload  levels.  As  a  result, 
there  may  be  insufficient  staff  or  staff  may  not  have  the  required  expertise. 

Work  Plannine  and  Control  -  The  work  planning  and  control  system  is  often  used  as  an 
integrated  scheduling  tool  to  match  the  workers  to  support  specific  jobs.  Weaknesses  in 
the  work  planning  and  control  system  may  result  in  the  assignment  of  too  few  or  too 
many  personnel  for  a  job  or  fail  to  ensure  that  only  qualified  personnel  are  assigned. 

Shift  Staffing  -  All  licensees  establish  a  shift  staffing  policy  that  defines  the  minimum 
required  levels  of  shift  personnel.  This  policy  is  often  integrated  with  the  scheduling  of 
individuals  to  shifts  and  overtime  management.  If  these  policies  are  not  clearly  defined, 
the  lack  of  clarity  can  cause  staffing  deficits  that  set  the  stage  for  human  errors. 

Training  -  The  training  program  ensures  that  personnel  are  qualified  for  their  jobs  and 
that  managers  are  trained  to  implement  shift  staffing  and  overtime  policies.  Sometimes, 
these  policies  may  be  difficult  to  understand.  Weaknesses  in  the  training  program  may 
fail  to  assure  that  supervisory  personnel  understand  staffing  requirements,  for  example. 

Human  Factors  Engineering  -  The  human  factors  engineering  program  ensures  that 
the  number  of  personnel  required  and  the  expertise  they  will  need  are  considered 
whenever  new  equipment  or  systems  are  installed.  Weaknesses  in  this  program  may 
result  in  too  few  or  too  many  personnel  assigned  to  a  job  or  in  the  installation  of 
systems  that  staff  cannot  operate  with  their  existing  KSAs. 
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13.4  ADDITIONAL  RESOURCES  ON  STAFFING 

•  U.S.  Code  of  Federal  Regulations,  Part  50.54(m),  Conditions  of  licenses.  Title  10, 
Energy  (revised  periodically).  Washington,  DC:  U.S.  Government  Printing  Office. 

•  U.S.  Code  of  Federal  Regulations,  Appendix  R  to  Part  50,  Quality  assurance  criteria  for 
nuclear  power  plants  and  fuel  reprocessing  plants,  Criterion  III  (H),  Fire  brigade.  Title 
10,  Energy  (revised  periodically).  Washington,  DC:  U.S.  Government  Printing  Office. 

•  U.S.  Nuclear  Regulatory  Commission  (1995).  Results  of  shift  staffing  study  (Information 
Notice  95-48).  Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1991).  Shift  staffing  at  nuclear  power  plants 
(Information  Notice  91-77).  Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 
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requirements  (NUREG-0737,  Supplement  1).  Washington,  DC:  U.S.  Nuclear 
Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1982).  NUREG-0737  technical  specifications 
(Generic  Letter  82-16).  Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1981).  Standard  review  plan,  (NUREG-0800), 
Chapter  13,  Conduct  of  operations.  Sections  13.1.1-13.1.3.  Washington,  DC:  U.S. 
Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1980).  T Ml  action  plan  (NUREG-0737). 
Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  Hallbert,  B.P.,  Sebok,  A.  and  Morisseau,  D.  (2000).  A  study  of  control  room  staffing 
levels  for  advanced  reactors  (NUREG/IA-0137).  Washington,  DC:  U.S.  Nuclear 
Regulatory  Commission. 
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14  SUPERVISION 


14.1  SUPERVISION  AND  HUMAN  PERFORMANCE 

Supervision  is  the  process  by  which  work  is  directed  and  overseen  by  first-line  management. 
Successful  supervision  requires  a  combination  of  leadership  skills  and  technical  competence. 
Supervision  differs  from  peer  checking  or  quality  control  because  a  supervisor  has  line 
management  responsibility  for  the  worker(s)  as  well  as  responsibility  for  the  work  activity. 

Supervision  is  more  than  the  moment-to-moment  direction  of  a  work  activity.  Successful 
supervision  requires  the  assessment  and  shaping  of  worker  attitudes  and  motivation, 
communication  and  implementation  of  management  expectations  for  performing  work,  the 
assignment  of  the  best-qualified  workers  to  various  tasks,  as  well  as  the  technical  competence  to 
identify  incorrect  actions  and  stop  improper  activities  before  an  error  is  committed.  Effective 
supervision  involves  directing  the  work,  overseeing  how  it  is  performed  and  leadership. 

14.1.1  Direction 

Directing  work  activities  includes  defining  desired  outcomes,  planning,  organizing  and 
controlling  work,  and  problem  solving.  Direction  occurs  during  preparation  for  a  task  and  during 
task  performance. 

The  role  of  supervision  during  work  preparation  is  to  assure  that  the  personnel  who  will  be 
performing  the  task  have  the  information  and  resources  required  to  perform  effectively.  These 
resources  include  knowledge  of  the  goal(s)  of  the  work  activity  as  well  as  management 
expectations  for  how  the  work  is  to  be  performed.  Goals  and  expectations  are  often 
communicated  during  pre-job  walkthroughs  of  the  task  environment  and  in  pre-job  briefings. 
Supervisors  may  also  be  required  to  ensure  that  the  personnel  assigned  to  perform  the  task  are 
qualified,  that  the  necessary  tools  and  equipment  are  available,  and  that  procedures  and  other 
instructions  for  performing  the  task,  such  as  those  included  in  a  work  package,  are  complete  and 
understood  by  the  workers.  Supervisors  may  be  responsible  for  verifying  that  the  prerequisite 
conditions  for  tagging  equipment  out-of-service  are  met  before  the  work  begins  and  for  obtaining 
authorization  to  start  the  task. 

Supervisors  act  as  a  resource  during  performance  of  the  work  activity.  Workers  may  call  on 
them  to  answer  questions,  provide  instructions  in  ambiguous  or  unanticipated  situations  and 
problem-solve.  Supervisors  also  are  the  interface  between  the  work  group  performing  the  task 
and  other  parts  of  the  organization,  including  more  senior  management.  Interface  responsibilities 
may  include  requesting  additional  resources  to  complete  the  task,  obtaining  authorization  to 
change  the  work  plan  or  stopping  work  if  unexpected  conditions  arise. 

Personnel  generally  respond  well  to  a  supervisor  when  they  have  confidence  in  his  or  her 
technical  background.  Conversely,  a  supervisor  with  inadequate  technical  qualifications  can 
foster  resentment  and  degrade  team  performance  because  the  supervisor  cannot  fulfill  some  of 
his  or  her  responsibilities  to  the  team.  A  first-line  supervisor  who  is  not  technically  competent 
may  direct  the  work  incorrectly. 
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Errors  due  to  poor  supervisory  direction  may  arise  when  any  of  the  supervisor’s  responsibilities 
for  directing  the  work  are  not  met.  For  example,  on  a  task  that  will  be  repeated  several  times  on 
different  components,  a  supervisor  may  decide  that  a  walkthrough  and  the  pre-job  briefing  need 
only  be  done  once  before  the  task  is  performed  the  first  time.  If  the  same  task  is  performed  over 
several  weeks  or  days,  system  configurations  may  change  between  jobs  or  the  personnel  who  are 
on-shift  and  assigned  to  perform  the  work  may  change.  Without  the  walkthrough  and  briefing 
before  the  task  is  performed  each  time,  personnel  may  commit  errors  because  they  are  unaware 
of  changed  plant  conditions  or  newly  assigned  personnel  may  not  have  a  full  understanding  of 
the  task  requirements. 

14.1.2  Oversight 

In  addition  to  directing  work  activities,  first-line  supervisors  typically  are  responsible  for 
overseeing  performance  of  the  work.  Supervisory  oversight  entails  monitoring  the  work  activity 
to  ensure  it  is  performed  in  accordance  with  the  work  plan,  procedures  and  management 
expectations. 

Effective  supervisors  are  technically  qualified  to  independently  detect  and  correct  errors,  with 
the  same  or  a  superior  level  of  technical  knowledge  as  the  worker  performing  the  task.  Although 
this  is  not  always  possible,  it  is  important  for  high  risk,  complex  activities.  The  best  supervisor 
for  a  particular  task  is  not  always  a  higher-level  manager  who  may  be  less  familiar  with  the 
details  of  the  task.  A  worker  who  was  recently  promoted  to  the  ranks  of  first-line  supervisors 
may  provide  more  effective  oversight  if  he  or  she  has  recent  technical  knowledge  of  the  activity 
and  has  mastered  the  necessary  supervisory  skills. 

The  supervisor  may  or  may  not  participate  in  the  work  assignment,  but  if  he  or  she  participates, 
the  ability  to  concurrently  provide  oversight  may  be  momentarily  lost  or  reduced.  The  key 
element  of  supervisory  oversight  is  that  it  provides  a  “second  pair  of  eyes”  not  involved  in  the 
work  activity  that  can  detect  errors  and  act  promptly  to  correct  them. 

14.1.3  Leadership 

Leadership  involves  motivating  personnel,  building  trust,  maintaining  accountability  and 
empowering  action.  As  the  first  level  of  line  management,  the  supervisor  plays  a  key  role  in 
establishing  and  maintaining  the  work  group’s  norms,  values  and  safety  culture.  In  addition,  the 
supervisor’s  leadership  style  will  affect  the  team’s  performance. 

Supervisors  translate  and  apply  general  organizational  goals  and  management  expectations  to  the 
specific  activities  of  the  work  group.  This  process  occurs  both  overtly,  with  explicit 
communications  about  goals  and  expectations,  as  well  as  indirectly.  Goals  and  expectations,  for 
example,  may  be  communicated  indirectly  by  the  example  the  supervisor  sets  with  his  or  her 
work  behavior,  such  as  the  extent  to  which  he  or  she  takes  short-cuts  when  performing  tasks. 
Expectations  may  also  be  indirectly  communicated  through  tacit  behaviors,  such  as  a  failure  to 
correct  worker  actions  that  achieve  production  goals  while  circumventing  safe  work  practices. 
Supervisors  also  communicate  goals  and  enforce  management  expectations  through  the  worker 
behaviors  that  they  reward  with  recommendations  for  promotions,  merit  raises  and/or  bonuses, 
desirable  work  assignments,  training  opportunities  and  overtime  allocations,  and  even  with  such 
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subtle  rewards  as  individual  attention  for  some  subordinates.  Supervisors  may  overtly  or 
covertly  discourage  a  questioning  attitude  among  workers,  for  example,  by  not  taking  time  to 
fully  answer  questions  during  meetings,  or,  at  an  extreme,  by  ridiculing  staff  members  who  raise 
questions  and  concerns. 

In  addition  to  communicating  organizational  goals  and  management  expectations,  the 
supervisor’s  leadership  style  affects  team  performance.  The  research  literature  shows  that 
leadership  styles  generally  range  from  participative,  with  a  focus  on  establishing  and  maintaining 
good  interpersonal  relations,  to  authoritarian  and  task-focused.  The  most  effective  leadership 
style  in  a  given  work  situation  depends  upon  the  characteristics  of  the  work  situation  and  of  the 
team  members. 

A  participative  leadership  style  is  effective  when  team  members  are  experienced,  the  task  is 
moderately  structured,  and  time  pressure  is  absent.  For  example,  a  brainstorming  session  for  the 
development  of  an  improved  work  control  process  will  benefit  from  participative  leadership 
where  the  formal  operational  lines  of  authority  are  suppressed  and  the  participants  interact  as 
equals. 

A  more  authoritarian  leadership  style  is  effective  when  team  members  are  new  to  the  task,  the 
work  is  either  unstructured  or  is  highly  structured,  or  the  work  must  be  completed  under  time 
pressure.  In  a  nuclear  power  plant  control  room,  for  example,  authoritarian  leadership  would  be 
critical  during  emergency  operations  if  a  crew  were  faced  with  new  and  unanticipated 
circumstances  and  had  to  respond  rapidly. 

An  effective  supervisor  adapts  his  or  her  personal  style  to  the  requirements  of  the  task  at  hand. 
This  flexibility  does  not  come  naturally  to  many  people  and  supervisory  training  may  be  required 
to  modify  an  individual’s  leadership  style.  For  example,  an  experienced  first-line  supervisor 
with  a  strong  authoritarian  personality  that  served  him  or  her  well  in  the  maintenance  department 
may  have  to  adopt  a  more  participative,  coaching  style  of  leadership  when  he  or  she  is  promoted 
to  a  management  position.  Supervisors  who  are  able  to  change  leadership  style  to  adapt  to  the 
demands  of  the  situation  lead  consistently  high  performing  teams. 

Mismatches  between  the  leadership  style  applied  in  a  given  work  situation  and  the  task  demands 
may  cause  or  contribute  to  errors  in  several  ways.  For  example,  team  members  may  attempt  to 
debate  a  verbal  instruction  from  a  supervisor  who  has  been  consistently  participative  at  a  time 
when  it  is  necessary  to  implement  an  order  promptly.  A  consistently  authoritarian  leadership 
style  may  discourage  team  members  from  offering  ideas  that  could  solve  a  problem  or  from 
raising  valid  concerns  when  their  input  could  prevent  an  unwanted  outcome. 

14.2  DIRECT  CAUSES  OF  SUPERVISION  ERRORS 

A  direct  cause  of  a  supervision  error  describes  the  characteristics  of  supervision  that  either 
caused  the  human  error  or  failed  to  prevent  a  human  error  when  prevention  was  possible. 
Supervision  may  play  a  role  in  errors  through  weaknesses  in  direction,  oversight  or  leadership. 
Specific  examples  of  direct  supervisory  causes  for  errors  are  presented  below. 
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14.2.1  Direction 


Task  goals  not  defined  -  Task  performance  failed  because  personnel  were  not  informed 
of  the  goals  of  the  task  by  supervision  prior  to  starting  the  job.  As  a  result,  for  example, 
the  job  may  be  performed  on  the  wrong  system  or  equipment  or  performed  incorrectly. 

Task  methods  not  defined  -  Task  performance  failed  because  personnel  did  not  receive 
necessary  guidance  from  supervision  regarding  management  expectations  for  how  the 
task  was  to  be  performed.  The  supervisor  may  not  have  provided  a  pre-job  briefing  or 
ensured  that  the  work  package  was  complete  and  included  the  necessary  drawings  or 
procedures. 

Unusual  or  hazardous  conditions  not  identified  -  Task  performance  failed  because 
unusual  or  hazardous  conditions  at  the  worksite  were  unknown  to  the  workers. 
Supervision  may  not  have  walked  down  the  job  in  advance  with  the  workers  to  identify 
any  unusual  equipment  or  environmental  conditions  that  could  require  special  tools  or 
equipment  or  a  change  to  the  planned  work  methods.  As  a  result,  errors  may  occur  when 
the  workers  encounter  unexpected  conditions. 

Prerequisites  not  met  -  Task  performance  failed  because  supervision  did  not  ensure  that 
all  of  the  prerequisite  conditions  were  met  prior  to  allowing  the  job  to  start.  As  a  result, 
for  example,  necessary  tools  and  equipment  were  not  available  to  perform  the  work 
timely,  or  the  equipment  was  not  tagged  out  and  ready  for  the  work  to  be  performed. 

Authorization  not  obtained  -  Task  performance  failed  because  supervision  did  not  ensure 
that  authorization  was  received  before  the  job  was  started,  or,  if  the  work  was  delayed, 
that  the  authorization  continued  to  be  valid.  As  a  result,  for  example,  the  job  may  have 
conflicted  with  other  work  being  performed  or  safety  systems  may  have  been  taken  out  of 
service  without  the  control  room’s  knowledge. 

Resources  not  provided  -  Task  performance  failed  because  supervision  did  not  ensure 
that  workers  had  the  resources  required  to  perform  the  task.  These  resources  could 
include  information,  procedures,  guidance  or  assistance  in  solving  problems  that  arise. 

Qualifications  not  assured  -  Task  performance  failed  because  supervision  assigned 
workers  to  tasks  for  which  they  were  not  qualified.  As  a  result,  errors  were  committed 
and  the  task  was  performed  incorrectly  or  incompletely. 

Decisions/guidance  incorrect  -  Task  performance  failed  because  supervision  was  not 
technically  competent  to  direct  the  work  activity  and  so  made  decisions  or  provided 
guidance  that  was  technically  incorrect. 

14.2.2  Oversight 

No  oversight  -  Task  performance  failed  because  supervision  was  not  present  during  the 
performance  of  important  tasks  or  critical  portions  of  a  job,  with  the  result  that  errors 
were  not  detected,  corrected  or  prevented. 
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Oversight  unqualified  -  Task  performance  failed  because  supervisory  oversight  was 
present,  but  was  not  sufficiently  familiar  with  the  work  to  detect  and  correct  or  prevent 
errors. 

Oversight  distracted  -  Task  performance  failed  because  supervision  was  involved  in 
performing  the  job  or  attending  to  other  matters. 

14.2.3  Leadership 

Wrong  goals  -  Task  performance  failed  because  supervision  communicated,  directly  or 
indirectly,  an  emphasis  on  production  or  cost  goals  over  safety.  As  a  result,  for  example, 
workers  may  have  skipped  steps  or  used  alternate  methods  to  those  prescribed  in  the 
procedures  or  work  package  to  complete  the  job  quickly. 

Questioning  attitude  discouraged  -  Task  performance  failed  because  supervision,  directly 
or  indirectly,  discouraged  workers  from  questioning  work  practices  or  instructions.  As  a 
result,  workers  may  have  taken  actions  that  they  believed  were  incorrect  or  possibly 
unsafe,  or  started  work  without  fully  understand  the  task. 

Mismatched  leadership  style  -  Task  performance  failed  because  there  was  a  mismatch 
between  the  supervisor’s  leadership  style  and  the  task  demands.  As  a  result,  teamwork  or 
morale  were  adversely  affected  and  led  to  errors. 

14.3  PROGRAMMATIC  CAUSES  OF  SUPERVISION  ERRORS 

Programmatic  causes  for  supervision  errors  are  typically  found  in  the  licensee’s  human  resources 
and  training  programs.  Licensee  human  resources  programs  are  responsible  for  ensuring  that 
personnel  selected  and  promoted  to  supervisory  positions  are  qualified  to  supervise.  Selection 
and  promotion  processes  screen  for  technical  qualifications  and  often  also  assess  candidates’ 
decision-making  capabilities,  leadership  skills  and  other  attributes  that  predict  success  in  the 
position.  Technical  training  and  training  in  supervisory  skills  assure  that  supervisors  can  fulfill 
their  functions.  Other  programs  may  also  be  implicated. 

14.4  ADDITIONAL  RESOURCES  ON  SUPERVISION 

•  U.S.  Nuclear  Regulatory  Commission  (2000).  Qualification  and  training  of  personnel  for 
nuclear  power  plants  (Regulatory  Guide  1.8,  Rev.  3).  Washington,  DC:  U.S.  Nuclear 
Regulatory  Commission 

•  U.S.  Nuclear  Regulatory  Commission  (2000).  Medical  misadministrations  caused  by 
human  errors  involving  gamma  stereotactic  radiosurgery  (gamma  knife)  (Information 
Notice  2000-22).  Washington,  DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1981).  Standard  review  plan,  (NUREG-0800), 
Chapter  13,  Conduct  of  operations.  Sections  13.1.1-13.1.3.  Washington,  DC:  U.S. 
Nuclear  Regulatory  Commission. 
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15  HUMAN-SYSTEM  INTERFACE 


15.1  THE  HUMAN-SYSTEM  INTERFACE  AND  HUMAN  PERFORMANCE 

In  NUREG-071 1, "  Human  Factors  Engineering  Program  review  Model,"  the  human-system 
interface  (HSI)  is  defined  as  the  technology  through  which  personnel  interact  with  plant  systems 
to  perform  their  functions  and  tasks.  The  major  types  of  HSIs  include  alarms,  information 
systems,  and  control  systems.  Each  type  of  HSI  is  made  up  of  hardware  and  software 
components  that  provide  information  displays,  which  are  the  means  for  user-system  interaction, 
and  controls  for  executing  these  interactions.  Personnel  use  of  HSIs  is  influenced  directly  by  (1) 
the  organization  of  HSIs  into  workstations  (e.g.,  consoles  and  panels);  (2)  the  arrangement  of 
workstations  and  supporting  equipment  into  facilities,  such  as  a  main  control  room,  remote 
shutdown  station,  local  control  station,  technical  support  center,  and  emergency  operations 
facility;  and  (3)  the  environmental  conditions  in  which  the  HSIs  are  used,  including  temperature, 
humidity,  ventilation,  illumination,  and  noise. 

Use  of  the  HSI  is  also  affected  indirectly  by  other  aspects  of  plant  design  and  operation, 
including  training  (Section  9),  supervision  (Section  13),  staffing  (Section  14),  and 
communications  (Section  17),  which  are  addressed  in  other  modules.  Plant  procedures  also  are 
considered  part  of  the  HSI,  as  defined  by  NUREG-071 1.  However,  in  the  HPEP,  a  separate 
module  (Section  1 1)  addresses  the  information  content  and  design  of  procedures,  while  this 
section  addresses  the  user-system  interface  considerations  of  computer-based  procedure  systems 
as  part  of  the  HSI. 

In  determining  the  causes  of  a  human  performance  problem,  the  licensee  may  identify  specific 
characteristics  of  the  HSI  that  led  to  error.  Methods  for  evaluating  HSI  characteristics  and 
detailed  review  guidelines  are  available  in  NUREG-0700,  "Human  System  Interface  Design 
Review  Guideline."  The  major  topics  to  consider  in  evaluating  the  HSI  and  determining  whether 
HSI  characteristics  had  an  impact  on  an  error  are  summarized  below. 

15.1.1  HSI  Design  Process 

Licensees  are  responsible  for  the  original  design  of  an  HSI  and  any  subsequent  upgrades  and 
modifications,  whether  the  licensee,  a  contractor  or  vendor  did  the  work.  A  central  concern  of 
the  design  process  is  ensuring  that  the  HSI  will  support  correct  human  performance. 

There  are  three  important  goals  to  be  achieved  in  the  design  and  implementation  of  an  HSI. 

These  are: 

•  Design  for  operability  refers  to  designing  the  HSI  to  be  consistent  with  the  abilities  and 
limitations  of  the  personnel  who  will  be  operating  it.  Weaknesses  in  the  design  processes 
can  result  in  an  HSI  that  is  not  well  suited  to  the  tasks  that  personnel  must  perform  to 
ensure  plant  safety,  resulting  in  increased  workload,  decreased  performance  by  personnel, 
and  an  increased  likelihood  of  errors. 
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•  Design  for  maintainability  refers  to  designing  the  HSI  and  associated  plant  equipment 
to  ensure  that  personnel  are  able  to  perform  necessary  maintenance  activities  efficiently. 
Weaknesses  in  the  design  process  can  result  in  systems  that  impose  excessive  demands 
on  personnel  for  maintenance  and,  therefore,  are  prone  to  maintenance  errors  or  problems 
with  reliability  and  availability. 

•  Design  for  implementation  refers  to  the  way  that  changes,  such  as  upgrades  to  the  HSI, 
are  planned  and  put  into  use.  A  new  HSI  component  may  require  the  user  to  perform 
functions  and  tasks  in  new  ways.  Skills  that  the  user  developed  for  managing  workload 
when  using  the  former  design,  such  as  ways  for  scanning  information  or  executing 
control  actions,  may  no  longer  be  compatible  with  the  new  design.  The  new  HSIs  must 
also  be  compatible  with  the  remaining  HSIs  so  that  operators  can  use  them  together  with 
limited  possibilities  for  human  error.  Also,  HSI  modifications  may  not  be  installed  or  put 
into  service  all  at  one  time,  causing  the  user  to  adapt  to  temporary  configurations  that  are 
different  from  both  the  original  and  final  configurations.  Weaknesses  in  HSI 
implementation  can  increase  operator  workload  and  the  likelihood  of  errors. 

15.1.2  HSI  Characteristics 

The  characteristics  of  HSIs  that  have  been  found  to  affect  human  performance  are  discussed 
below.  In  this  section,  each  HSI  characteristic  is  introduced  and  defined,  and  the  potential 
impacts  of  HSI  weaknesses  on  performance  are  briefly  discussed. 

15.1.2.1  Information  Display 

Information  display  refers  to  the  way  that  information  is  presented  to  personnel.  Both  the 
display  devices  and  the  displays  contained  in  the  devices  are  addressed  by  this  topic.  Display 
device  considerations  include  their  location  in  the  work  environment  and  factors  that  affect 
legibility,  such  as  brightness  and  flicker.  Display  considerations  include  how  information  is 
organized  and  presented  within  the  display  device.  A  display  page  is  a  set  of  information  that  is 
presented  at  one  time  by  a  display  device.  Display  formats  refer  to  standard  groupings  of 
information  within  pages,  including  text,  tables,  graphs,  and  mimics.  Display  elements  refer  to 
the  items  that  make-up  the  formats,  such  as  characters,  numbers,  symbols,  and  icons.  Other 
considerations  include  whether  needed  information  is  present  and  available,  and  the  quality  (i.e., 
reliability)  of  the  plant  data  provided  to  the  user.  Weaknesses  in  information  display  can  affect 
the  ability  of  personnel  to  promptly  and  correctly  detect,  read,  and  understand  information 
needed  to  perform  their  tasks. 

15.1.2.2  User-System  Interaction 

User-system  interaction  is  the  set  of  methods  provided  in  a  computer  system  through  which 
personnel  and  the  computer  communicate  with  each  other.  The  following  topics  are  included. 
User  input  formats  refers  to  the  type  of  dialogue  between  the  user  and  the  computer.  Cursors 
are  pointers  that  indicate  the  position  of  the  user’s  operation  on  a  display  screen.  System 
response  refers  to  the  manner  in  which  the  computer  system  behaves  after  receiving  inputs  from 
the  user.  Managing  displays  refers  to  the  actions  performed  by  a  user  to  control  the  way  that 
individual  displays  are  presented  on  a  device.  Managing  information  refers  to  capabilities  that 
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allow  the  user  to  create,  change,  store,  and  retrieve  documents  via  the  computer.  Managing 
errors  refers  to  features  that  support  the  prevention,  detection,  and  correction  of  errors.  Help 
refers  to  features  that  provide  guidance  to  the  user  (e.g.,  describes  how  the  user  interface  works). 
System  security  includes  features  that  restrict  personnel  access  to  aspects  of  the  computer 
system  to  prevent  accidental  or  deliberate  damage.  Weaknesses  in  user-system  interaction  can 
increase  the  amount  of  effort  for  the  user  to  find  and  arrange  needed  information.  These 
weaknesses  can  also  inhibit  the  user’s  ability  to  prevent,  detect,  correct,  and  recover  from  errors. 

15.1.2.3  Controls 

Controls  are  devices  that  personnel  use  to  interact  with  the  HSI  and  the  plant.  They  may  be 
conventional,  hardwired  control  devices  or  computer-based  input  devices.  Weaknesses  in  the 
design  of  control  devices,  whether  conventional  or  computer-based,  can  interfere  with  the  ability 
of  users  to  perform  control  or  input  actions  promptly  and  without  errors. 

15.1.2.4  Alarm  Systems 

Alarm  systems  are  automated  systems  consisting  of  processing  and  display  hardware  and 
software,  which  analyze  signals  from  plant  sensors  and  alert  the  operator  via  visual  or  auditory 
displays  (i.e.,  when  the  monitored  parameters  deviate  from  specified  limits).  Important 
characteristics  include  processing  functions;  information  display;  user-system  interaction; 
controls;  reliability;  test  and  maintenance  capabilities;  failure  indications;  alarm  response 
procedures;  control-display  coordination;  and  its  integration  with  the  rest  of  the  HSI.  Alarm 
system  weaknesses  can  increase  personnel  workload  associated  with  finding  and  assessing  plant 
information  and  decrease  operator  awareness  of  plant  status. 

15.1.2.5  Soft  Control  Systems 

These  are  computer-based  systems  that  provide  operators  with  control  interfaces  that  are 
mediated  by  software  rather  than  direct  physical  connects,  as  in  hard-wired  knobs  and  buttons. 
Soft  controls  can  be  used  to  control  plant  equipment,  such  as  a  pump,  or  the  HSI,  such  as  in 
selecting  a  display.  Important  characteristics  of  soft  control  systems  include  the  information 
display,  user-system  interaction,  controls,  and  integration  with  the  rest  of  the  HSI.  Weaknesses 
in  the  design  of  soft  control  systems  can  increase  the  likelihood  of  human  performance  problems, 
such  as  unintentional  actuation,  incorrect  inputs  (i.e.,  wrong  control,  wrong  input  value),  and 
delayed  completion  of  control  actions. 

15.1.2.6  Computer-Based  Procedure  Systems 

These  systems  present  plant  procedures  in  computer-based  rather  than  paper-based  formats. 
Computer-based  procedures  (CBP)  systems  can  present  procedures  steps  and  plant  status 
information  in  ways  that  better  support  decision-making.  They  can  also  include  capabilities  for 
managing  multiple  procedures  and  procedure  steps.  Important  characteristics  include  processing 
capabilities  (automation  for  procedure  functions),  information  display,  user-system  interaction, 
controls,  and  integration  with  the  rest  of  the  HSI.  Weaknesses  in  the  design  of  CBP  systems  can 
increase  workload  associated  with  assessing  plant  status  and  selecting  appropriate  responses  and 
decrease  operator  awareness  of  plant  status. 
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15.1.2.7  Computerized  Operator  Support  Systems 

These  systems  use  computer  technology  to  support  operators  or  maintenance  personnel  in 
situation  assessment  and  response  planning.  They  can  monitor  status  and  provide 
recommendations  or  warnings.  Example  applications  include:  fault  detection  and  diagnosis, 
safety  function  monitoring,  plant  performance  monitoring,  core  monitoring,  maintenance 
advising,  and  operator  support  for  plant  control.  Important  characteristics  include  processing 
capabilities,  information  display,  user-system  interaction,  controls,  and  integration  with  the  rest 
of  the  HSI.  Weaknesses  in  the  design  of  computerized  operator  support  systems  can  increase 
workload  associated  with  assessing  plant  status  and  selecting  appropriate  responses  and  decrease 
operator  awareness  of  plant  status. 

15.1.2.8  Workstations 

Control,  display,  and  alarm  devices  of  the  HSI  are  often  organized  into  workstations  where  crew 
functions  and  tasks  are  performed.  Examples  include  sit-stand  workstations,  stand-up  consoles, 
sit-down  consoles,  vertical  panels,  and  desks.  Workstation  characteristics  affect  reach,  vision, 
comfort,  the  ability  to  gather  and  compare  information  across  display  devices,  and  the  ability  to 
use  control  and  display  devices  in  a  coordinated  fashion.  Weaknesses  in  workstation  design  can 
interfere  with  the  ability  of  personnel  to  detect  important  information  or  accurately  perform 
control  and  computer  input  actions. 

15.1.2.9  Control  Room 

A  control  room  is  a  facility  in  which  controls  and  displays  of  the  HSI  are  centralized  (e.g.,  the 
main  control  room  and  the  technical  support  center).  Two  important  aspects  of  a  control  room 
are  its  configuration  (i.e.,  its  arrangement  of  workstations  and  other  equipment)  and  its 
environment  (i.e.,  the  adequacy  of  lighting,  temperature,  humidity,  and  ventilation  for  normal 
and  emergency  conditions).  Weaknesses  in  control  room  layout  may  interfere  with  the  ability  of 
personnel  to  detect  and  monitor  information  and  interact  with  each  other.  Weaknesses  in 
lighting  may  affect  the  ability  of  personnel  to  accurately  read  displays,  procedures,  and  other 
information  sources.  Weaknesses  in  lighting,  temperature,  humidity,  or  ventilation  may  also 
affect  personnel  alertness,  comfort,  and  health. 

15.1.2.10  Local  Control  Stations 

Local  control  stations  are  places  outside  of  the  main  control  room,  where  operators  interact 
with  the  plant.  They  may  include  multifunction  workstations  and  panels,  as  well  as  individual 
interfaces,  such  as  controls  (e.g.,  valves,  switches,  and  breakers)  and  displays  (e.g.,  meters  and 
VDUs).  When  implemented  in  environments  that  are  not  as  carefully  controlled  as  the  main 
control  room,  local  control  stations  may  have  special  considerations  such  as  high  levels  of 
background  noise  and  severe  environmental  conditions.  Weaknesses  in  control  station  layout 
may  interfere  with  the  ability  of  personnel  to  detect  and  monitor  information,  perform  control 
actions,  and  interact  with  other  personnel.  Weaknesses  in  lighting  may  affect  the  ability  of 
personnel  to  accurately  read  displays,  procedures,  and  other  information  sources.  Weaknesses  in 
temperature,  humidity,  or  ventilation  may  affect  personnel  performance,  comfort,  health,  and 
safety. 
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15.1.2.11  Maintainability  Features 

All  plant  equipment,  including  the  HSI,  must  be  periodically  maintained.  The  design  of  the 
maintenance  interfaces  of  plant  equipment  and  the  tools  used  in  maintenance  tasks  can  affect 
personnel  performance  for  these  tasks.  Maintainability  refers  to  the  design  of  features  and 
capabilities  that  support  personnel  in  detecting  equipment  failures  and  performing  necessary 
preventive,  routine,  and  corrective  maintenance.  This  includes  the  layout  of  components  that 
must  be  maintained,  labels  and  markers,  controls  for  adjusting  equipment,  test  points,  service 
points,  and  test  equipment  (e.g.,  the  user  interfaces  and  capabilities  of  diagnostic  devices).  An 
area  that  is  posing  increasing  human  performance  challenges  in  NPPs  is  the  maintenance  of 
digital  systems,  due  to  the  complexity  of  these  systems  and  their  susceptibility  to  incorrect 
actions.  Some  maintainability  considerations  for  digital  systems  include  the  design  of: 
instrument  cabinets  and  racks,  equipment  packaging  within  these  enclosures,  and  fuses  and 
circuit  breakers.  Weaknesses  in  the  design  of  maintenance  interfaces  and  tools  can  increase  the 
likelihood  of  maintenance  errors  and  the  amount  of  time  needed  to  complete  maintenance  tasks. 
This  may  increase  the  occurrence  of  plant  transients  or  decrease  the  availability  of  plant 
equipment  needed  to  ensure  plant  safety. 

15.2  DIRECT  CAUSES  OF  HSI-RELATED  ERRORS 

A  direct  cause  of  an  HSI-related  error  describes  characteristics  of  the  HSI  that  caused  task 
performance  to  fail.  There  are  a  number  of  ways  in  which  the  HSI  may  cause,  contribute  to  or 
fail  to  prevent  an  error.  These  include: 

15.2.1  Information  Display 

No  display  or  information  not  available  -  Needed  information  was  not  displayed  or  the 
information  that  a  display  was  intended  to  provide  was  not  available.  As  a  result,  the  user 
did  not  have  access  to  the  information  needed  to  perform  the  task. 

Display  formats,  elements  or  pages  unsuitable  -  The  display  was  formatted  (e.g.,  text, 
tables,  graphs,  mimics,  speech  output)  or  display  elements  (e.g.,  characters,  numbers, 
symbols,  icons)  were  presented  in  a  manner  that  made  them  difficult  to  read,  understand 
or  use.  As  a  result,  personnel  did  not  or  could  not  use  the  information  displayed  when 
performing  the  task. 

Data  quality  and  update  rate  inadequate  -  The  display  did  not  provide  useful  indications 
of  the  quality  of  the  data  that  was  provided  or  the  update  rate  of  the  data  was  too  slow  to 
be  useful.  As  a  result,  users  were  unable  to  depend  on  and  use  the  information  displayed 
to  guide  task  performance. 

Display  equipment  inadequate  -  The  equipment  used  to  display  information  (e.g.,  VDUs, 
printers,  plotters,  meters,  light  indicators,  numerical  readouts,  and  audio  devices)  did  not 
work  or  was  unsuitable  for  performing  the  task.  As  a  result,  users  did  not  have  access  to 
necessary  information. 
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15.2.2  User-System  Interaction 


User  input  formats  unsuitable  -  The  format  provided  by  which  personnel  interacted  with 
the  system  (e.g.,  command  language,  menus,  function  keys,  response  entry  forms,  direct 
manipulation,  query  language)  was  unsuitable  for  the  task.  As  a  result,  user  inputs  were 
delayed  or  input  errors  occurred. 

Cursor  inadequate  -  The  type  of  cursor  provided  was  too  small  or  otherwise  difficult  to 
see  on  the  screen,  or  was  difficult  to  manipulate  and  understand.  As  a  result,  task 
performance  was  delayed  or  input  errors  were  committed. 

System  response  inadequate  -  The  HSI  did  not  provide  adequate  feedback  to  the  user  or 
response  times  were  too  slow.  For  example,  prompts  regarding  the  expected  input  were 
not  provided,  no  feedback  was  given  when  the  user  entered  an  input,  or  the  time  between 
an  input  and  the  system’s  response  to  it  was  too  slow  to  maintain  control. 

Display  management  difficult  -  Methods  for  managing  displays  (e.g.,  selection, 
navigation,  freeze/update,  scroll,  page,  pan  and  zoom)  were  not  provided  or  difficult  to 
use.  As  a  result,  personnel  could  not  access  needed  information  or  could  not  access  it 
timely. 

Information  management  inadequate  -  Means  to  create,  change,  store  and  retrieve 
documents  were  not  provided  or  were  difficult  to  use.  As  a  result,  needed  information 
was  lost. 

Errors  difficult  to  detect  and  correct  -  The  HSI  did  not  provide  means  to  catch  input 
errors  or  provide  easy  means  to  correct  them.  As  a  result,  errors  were  made  and  neither 
detected  nor  corrected. 

Help  function  missing  or  inadequate  -  Assistance  in  using  the  system  was  not  provided  or 
was  difficult  to  access.  As  a  result,  personnel  could  not  use  the  system  to  perform  their 
tasks. 

System  not  secure  -  Security  features  were  missing.  As  a  result,  personnel  caused 
accidental  or  deliberate  damage. 

15.2.3  Controls  and  Soft  Control  Systems 

Controls  not  available  -  The  HSI  did  not  provide  all  the  controls  necessary  to  perform  the 
task.  For  example,  controls  were  not  available  for  selecting  plant  variables  to  view  or  to 
act  upon  or  means  were  not  provided  for  monitoring  feedback. 

Controls  not  integrated  -  Control  actions  or  control  devices  were  inconsistent  or 
incompatible  with  other  aspects  of  the  HSI.  As  a  result,  personnel  took  incorrect  actions 
when  operating  the  controls. 
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Computer-based  input  devices  inadequate  -  The  input  devices  (e.g.,  keyboards, 
trackballs,  joysticks,  mice,  touch  screens,  light  pens,  graphic  tables  and  speech  input 
devices)  did  not  work  or  were  unsuitable  for  the  task.  As  a  result,  user  inputs  were 
delayed  or  errors  committed. 

Conventional  control  devices  inadequate  -  The  hardwired  control  devices  (e.g.,  push 
buttons,  rotary  controls,  thumbwheels  and  switches)  did  not  work  or  were  unsuitable  for 
the  task.  As  a  result,  control  actions  were  delayed  or  errors  occurred. 

No  backups  -  Alternate  means  for  taking  control  actions  on  critical  tasks  were  not 
provided  should  the  controls  fail.  For  example,  no  hardwired  backups  for  soft  controls 
were  available,  if  the  soft  controls  failed. 

15.2.4  Alarm  Systems 

Alarm  functions  missing  -  Alarms  to  alert,  inform,  guide  or  assist  personnel  were  not 
provided.  As  a  result,  personnel  did  not  detect  important  changes  in  system  state  or  did 
not  have  access  to  needed  information  to  perform  their  tasks. 

Alarm  display  inadequate  -  Necessary  information  was  not  presented  in  either  an 
auditory  or  visual  format  that  was  effective  in  drawing  attention  and  conveying  detailed 
information.  As  a  result,  personnel  had  difficulty  detecting  and  diagnosing  system  states, 
leading  to  errors. 

User-alarm  interactions  inadequate  -  Silence,  acknowledge,  reset  and  test  controls  were 
not  provided  or  did  not  function  correctly.  As  a  result,  the  user  was  unable  to  interact 
effectively  with  the  alarm. 

Failure  indications  missing  -  The  alarm  system  did  not  indicate  when  it  was  not 
functioning  or  it  was  difficult  to  determine  whether  the  alarm  was  operable.  As  a  result, 
personnel  were  not  aware  that  alarms  were  not  operable  and  so  did  not  detect  important 
changes  in  plant  state. 

Alarm  response  guidance  missing  -  Detailed  information  about  alarm  conditions  and 
appropriate  actions  to  take  in  response  to  alarms  (e.g.,  alarm  response  procedures)  was 
not  available  to  personnel.  As  a  result,  response  was  delayed  or  incorrect. 

Alarms  not  integrated  -  Display  and  control  arrangements  for  the  alarm  system  were 
difficult  to  use  or  were  inconsistent  or  incompatible  with  the  rest  of  the  HSI.  As  a  result, 
incorrect  actions  were  taking  when  interacting  with  the  alarms  or  use  of  the  alarm  system 
interfered  with  actions  required  by  other  aspects  of  the  HSI. 

15.2.5  Computer-based  Procedures  and  Operator  Support  Systems 

Information  missing  or  inadequate  -  The  computer-based  procedures  or  computerized 
operator  support  systems  did  not  provide  the  information  users  required  or  it  was  not 
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presented  in  a  format  that  supported  performance.  For  example,  the  level  of  detail  was 
insufficient  to  assist  personnel  in  decision-making. 

User-system  interactions  inadequate  -  The  computer-based  procedures  or  computerized 
operator  support  system  displays  and  controls  were  difficult  to  understand  or  manipulate. 
As  a  result,  personnel  responses  were  delayed  or  incorrect. 

Not  integrated  -  The  computer-based  procedures  or  computerized  operator  support 
systems  were  inconsistent  or  incompatible  with  the  rest  of  the  HSI.  For  example,  control 
and  display  devices  operated  differently  from  those  used  for  other  systems  leading  to 
errors. 

No  backups  -  No  alternate  hard-copy  procedures  or  hardwired  systems  were  provided  in 
case  of  computer-based  procedures  or  computerized  operator  support  system  failures.  As 
a  result,  if  the  systems  failed,  personnel  had  no  procedural  guidance  for  performing  their 
tasks. 

15.2.6  Workstations 

Configuration  inadequate  -  The  workstation  design  did  not  support  user  reach,  vision  or 
comfort.  As  a  result,  for  example,  personnel  became  fatigued,  could  not  see  important 
information  or  were  delayed  in  taking  control  actions. 

Layout  inadequate  -  The  layout  of  controls  and  displays  on  the  workstation  did  not 
support  control  actions.  As  a  result,  personnel  became  fatigued  or  made  errors  when 
using  the  controls. 

Labeling  and  demarcation  inadequate  -  Labels  and  markings  did  not  assist  users  in 
finding  and  identifying  controls,  displays  and  other  equipment.  As  a  result,  for  example, 
personnel  used  the  wrong  controls  for  the  intended  action  or  read  the  wrong  display. 

15.2.7  Control  Room 

Space  and  layout  inadequate  -  Sufficient  space  was  not  available  or  equipment  was  laid 
out  in  ways  that  it  was  difficult  for  personnel  to  view  or  access  information,  communicate 
or  walk  around.  Or,  there  was  inadequate  space  available  to  store  needed  procedures, 
other  documents,  spare  parts,  expendables,  tools,  protective  equipment  and  personal 
items.  As  a  result,  for  example,  procedures  could  not  be  laid  out  so  that  placekeeping 
was  difficult  or  needed  items  were  lost  and  prevented  task  completion. 

Supervisor  inaccessible  -  Access  to  the  shift  supervisor’s  office  via  walking  or 
communication  links  was  difficult.  As  a  result,  the  supervisor  was  unavailable  when 
needed  or  was  unable  to  maintain  awareness  of  control  room  activities. 
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Multi-units  not  distinguishable  -  Features  to  distinguish  between  controls  and  displays 
for  different  units,  or  mirror-image  control  rooms,  caused  personnel  to  incorrectly 
monitor  plant  parameters  or  take  control  actions  on  the  wrong  unit. 

15.2.8  Local  Control  Stations 

No  display  or  information  not  available  -  Needed  information  was  not  displayed  or  the 
information  that  a  display  was  intended  to  provide  was  not  available.  As  a  result,  the  user 
did  not  have  access  to  the  information  needed  to  perform  the  task. 

No  controls  or  controls  not  available  -  The  controls  necessary  to  perform  the  task  were 
either  missing  or  not  working  at  the  local  control  station.  As  a  result,  necessary  control 
actions  could  not  be  performed. 

Layout  inadequate  -  The  layout  of  controls  and  displays  at  the  local  control  station  did 
not  support  control  actions.  As  a  result,  personnel  could  not  accurately  determine  system 
status  and  made  incorrect  operational  decisions. 

Labeling  and  demarcation  inadequate  -  Labels  and  markings  did  not  assist  users  in 
finding  and  identifying  controls,  displays  and  other  equipment.  As  a  result,  for  example, 
personnel  used  the  wrong  controls  for  the  intended  action  or  read  the  wrong  display. 

15.2.9  Maintainability 

Equipment  inaccessible  -  The  arrangement  of  components  and  access  to  them  for 
inspection,  testing,  replacement  and  repair  was  inadequate.  As  a  result,  maintenance 
activities  were  delayed  or  errors  were  committed. 

Labeling  and  demarcation  inadequate  -  Labels  or  markings  did  not  support  proper 
identification  of  equipment  and  components.  As  a  result,  task  performance  was  delayed 
while  personnel  attempted  to  identify  the  correct  piping. 

Adjustment  controls  missing  or  inadequate  -  Control  devices  for  performing  adjustments 
on  equipment  were  not  provided  or  were  inconvenient  to  use.  As  a  result,  setpoints  could 
not  be  accurately  maintained. 

Test  and  service  points  missing  or  inadequate  -  Test  and  service  points  were  not  provided 
or  were  inconvenient  to  access  and  use.  As  a  result,  personnel  skipped  a  surveillance 
rather  than  attempt  to  access  a  test  point. 

Test  equipment  inadequate  -  Equipment  needed  for  testing  was  not  available,  was 
difficult  to  use,  was  miscalibrated  or  was  otherwise  not  properly  configured  for  the 
maintenance  task.  As  a  result,  the  maintenance  task  was  not  completed  or  equipment 
operability  following  maintenance  could  not  be  verified. 
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15.3  PROGRAMMATIC  CAUSES  FOR  HSI-RELATED  ERRORS 


Licensees  may  have  many  programs,  processes,  and  practices  to  ensure  that  human  factors 
engineering  considerations  are  properly  addressed  in  the  design  and  installation  of  the  HSI  and 
other  plant  equipment,  and  that  human  performance  considerations  continue  to  be  met  in  on¬ 
going  operations  after  installation.  There  are  three  primary  programs  or  processes  that  may  set 
the  stage  for  HSI  weaknesses  that  cause  errors.  These  are  the  HSI  design  and  implementation 
process,  and  maintenance  and  housekeeping  activities.  If  the  display  system  is  not  fully 
operational,  contains  outdated  information,  or  has  labels  that  are  either  illegible  due  to 
accumulated  dirt  or  missing,  the  licensee  should  consider  programmatic  causes  related  to  its 
repair,  maintenance,  and  general  housekeeping. 

HSI  Design  -  The  HSI  design  and  implementation  process  assures  that  original  HSI 
designs  and  upgrades  fully  meet  the  needs  of  operations  and  maintenance  personnel  and 
that  problems  are  avoided  when  the  new  design  is  put  into  service.  If  design  and 
implementation  processes  are  deficient,  weaknesses  will  exist  in  the  HSI.  For  example,  a 
poorly  designed  display  system  or  controls  that  are  difficult  to  use  may  result  from  an 
inadequate  design  process. 

Maintenance  -  A  licensee  may  have  a  variety  of  programs  for  ensuring  that  the  HSI  and 
plant  equipment  are  in  working  order  and  available  for  use.  These  include  preventative, 
routine,  and  corrective  maintenance  programs  for  both  hardware  and  software 
components.  An  important  concern  for  software  maintenance  is  ensuring  that  the 
computer  system  is  updated  with  the  most  current  and  correct  set  of  instructions  and  data. 
Another  maintenance  concern  is  the  replacement  of  missing  or  degraded  labels 
throughout  the  plant.  Weaknesses  in  these  programs  can  result  in  the  HSI  being 
inadequately  or  incorrectly  serviced,  resulting  in  problems  with  reliability  and 
availability. 

Housekeeping  -  Housekeeping  includes  activities  performed  to  maintain  a  clean  and 
orderly  work  environment.  Examples  include  cleaning  labels  and  displays  so  they  can  be 
easily  read,  cleaning  input  devices  so  they  can  be  used  properly,  removing  trash  and  used 
materials  to  eliminate  unnecessary  clutter,  and  storing  documents  so  they  can  be  readily 
accessed  when  needed.  Housekeeping  practices  refers  to  the  way  these  tasks  are 
performed  on  an  ongoing  basis  to  maintain  a  productive  work  environment.  Weaknesses 
in  housekeeping  practices  can  increase  operator  response  time  and  the  likelihood  of 
errors. 

15.4  ADDITIONAL  RESOURCES  ON  THE  HSI 

•  U.S.  Nuclear  Regulatory  Commission  (1996).  Standard  review  plan  for  the  review  of 
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Nuclear  Regulatory  Commission. 
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16  TASK  ENVIRONMENT 


16.1  EFFECTS  OF  ENVIRONMENTAL  FACTORS  ON  HUMAN  PERFORMANCE 

The  task  environment  refers  to  the  physical  conditions  in  which  work  is  performed. 
Environmental  conditions  that  can  affect  performance  include  excessive  vibration  and  noise, 
temperature  extremes  and  insufficient  lighting.  These  adverse  environmental  conditions  can 
stress  personnel,  interfere  with  performance  and  increase  the  likelihood  that  they  will  commit 
errors  while  performing  a  task.  Work  conditions  that  require  protective  gear,  such  as  high 
radiation  or  some  confined  space  environments,  or  that  require  unusual  physical  postures,  also 
can  interfere  with  task  performance,  as  may  poor  housekeeping. 

16.1.1  Vibration 

There  are  two  types  of  vibration  that  may  cause  errors.  The  first  is  whole-body  vibration,  in 
which  vibration  is  transferred  to  the  worker  from  standing  or  sitting  on  a  vibrating  surface.  The 
second  is  object  vibration,  in  which  a  stationary  worker  interacts  with  a  vibrating  object  in  some 
fashion.  The  effects  of  vibration  depend  upon  its  frequency  and  acceleration.  Frequency  is  the 
number  of  oscillations  (cycles)  that  occur  in  one  second.  Acceleration  is  the  force,  or  intensity, 
of  the  vibration. 

Whole-body  vibration  affects  personnel  comfort  levels.  As  discomfort  increases,  errors  may 
occur.  Personnel  are  most  uncomfortable  when  the  frequency  of  the  vibration  approaches  the 
resonance  point  of  the  human  body  (5  Hz)  and  can  tolerate  only  short  exposures.  Discomfort 
also  increases  as  acceleration  increases.  Discomfort  may  induce  errors  by  causing  personnel  to 
rush  through  their  work  or  by  distracting  them. 

Whole-body  vibration  also  affects  the  ability  to  control  fine  hand  and  arm  movements.  Vibration 
will  induce  errors  in  tasks  that  require  accurate  hand  and  arm  movement,  such  as  writing,  placing 
and  tightening  screws,  or  attaching  jumpers. 

Vibration  also  blurs  vision.  Errors  may  occur  from  vibration  on  tasks  that  require  accurate 
vision,  such  as  reading  instruments,  procedures  or  drawings. 

Object  vibration  may  also  adversely  affect  performance.  For  example,  errors  may  occur  when 
making  fine  adjustments  or  in  reading  instruments,  if  equipment  is  vibrating. 

16.1.2  Noise 

Noise  is  unwanted  sound.  Noise  can  cause  errors  in  several  ways.  It  may  disrupt 
communications,  affect  the  ability  to  perform  tasks  and  annoy  personnel. 

The  effects  of  noise  on  communications  are  complex.  Even  relatively  low  levels  of  noise  can 
mask  speech,  but  only  under  some  circumstances.  For  example,  speakers  naturally  raise  their 
voices  when  there  is  background  noise  and  may  be  able  to  overcome  some  of  its  effects  on 
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communication.  Being  able  to  see  the  speaker’s  face  or  using  standardized  phrases  also  improves 
communication  in  a  noisy  environment.  The  type  of  background  noise  also  affects 
communication.  It  is  easier  to  communicate  over  noise  that  is  steady  and  uniform  than  noise  that 
includes  sharp  tonal  peaks,  such  as  background  speech. 

Noise  has  been  shown  to  affect  decision-making,  memory,  vigilance,  attention  and  motor  skills. 
Whether  noise  will  cause  errors  depends  upon  (1)  the  degree  of  familiarity  with  the  noise,  (2)  the 
complexity  of  the  task  the  worker  is  performing  and  (3)  the  frequency  and  intensity  of  the  noise, 
measured  in  decibels. 

Familiar  noises  are  usually  continuous,  such  as  the  sound  of  freeway  traffic  or  the  hum  of  a 
motor.  Even  high  levels  of  familiar  noise  typically  do  not  impair  performance  on  simple  tasks 
and  will  cause  only  minor  effects  on  complex  tasks,  such  as  reading  or  decision-making. 

Unfamiliar  noise  is  more  disruptive.  Unfamiliar  noise  includes  speech,  alarms  and  some  kinds  of 
music.  Loud  and  unfamiliar  noise  may  cause  only  minor  performance  effects  on  simple  tasks, 
but  will  disrupt  performance  of  complex  tasks.  Multiple  alarms  sounding  simultaneously  in  a 
control  room,  for  example,  could  interfere  with  performance  of  complex  tasks. 

Unfamiliar,  loud  noise  is  also  annoying.  Annoyance  may  cause  workers  to  rush  through  their 
tasks  or  disrupt  teamwork.  Unexpected  and  unfamiliar  loud  noise,  such  as  sonic  booms  from 
line  breaks,  may  startle  personnel. 

16.1.3  Heat 

Heat  exposure  is  a  common  problem  in  many  areas  of  a  plant,  such  as  the  turbine  building  when 
the  plant  is  operating.  The  extent  to  which  workers  will  be  affected  by  heat  depends  on  many 
factors.  These  include  physical  characteristics,  such  as  age,  weight,  acclimation  to  heat,  physical 
fitness  and  dehydration.  Other  factors  that  determine  the  effects  of  heat  on  performance  include 
airflow,  humidity,  clothing  and  level  of  physical  activity. 

As  whole-body  temperature  (a  measure  of  internal  body  temperature  that  is  estimated 
externally  by  wet-bulb  globe  temperature  -  WBGT)  increases,  first  the  workers ’comfort  levels 
are  affected,  then  task  performance  is  affected,  followed  by  the  onset  of  heat  stress.  Performance 
of  perceptual/motor  tasks,  such  as  tracking,  monitoring,  and  manipulating  objects,  is  affected 
even  at  relatively  low  temperatures  (69°F  WBGT).  Performance  on  perceptual/motor  tasks 
degrades  over  the  first  two  hours  of  exposure,  and  then  levels  off.  Performance  of  mental  tasks, 
such  as  arithmetic  computations,  logical  reasoning,  and  recalling  information  from  memory, 
begins  to  degrade  sharply  after  about  30  minutes  of  exposure  to  temperatures  above  90°F 
WBGT,  but  then  levels  off.  When  workers  begin  to  experience  heat  stress,  they  may  become 
confused  and  disoriented,  in  addition  to  experiencing  physical  symptoms,  and  are  very  likely  to 
commit  errors  if  they  attempt  to  continue  working. 

16.1.4  Cold 

Exposure  to  cold  affects  the  performance  of  manual  tasks.  Decreases  in  the  ability  to  control 
hand  movements  begin  at  an  air  temperature  of  approximately  54°  F.  The  fingers  may  become 
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numb  to  pain  at  this  temperature  and  touch  sensitivity  is  reduced.  Performance  of  gross  manual 
tasks,  such  as  those  involving  the  arms  and  legs  is  also  degraded  at  54°  F.  The  speed  at  which 
manual  tasks  can  be  performed  is  affected  by  the  rate  of  cooling.  Slow  temperature  drops  have  a 
greater  negative  impact  on  manual  dexterity  than  rapid  temperature  decreases,  during  the  initial 
exposure  period. 

Hypothermia  occurs  when  a  worker  can  no  longer  maintain  an  adequate  deep-body  temperature. 
In  the  early  stages,  individuals  experience  lethargy,  clumsiness,  confusion  and  irritability.  As  the 
hypothermia  deepens,  hallucinations  or  arrested  breathing  will  occur. 

The  effects  of  cold  temperatures  on  performance  are  affected  by  clothing,  whether  exposed  skin 
and  clothing  are  wet  or  dry,  air  movement  (wind  chill)  and  the  length  of  exposure.  Performance 
impairments  may  be  experienced  at  higher  air  temperatures  than  those  discussed  above  if 
workers  are  not  dressed  warmly,  their  skin  or  clothing  is  wet,  or  they  are  exposed  to  air 
movement  or  to  cold  temperatures  for  extended  periods  of  time. 

16.1.5  Lighting 

Adequate  lighting  is  required  for  accurate  performance  of  nearly  every  task  in  a  nuclear  power 
plant.  Visibility  depends  upon  several  factors: 

•  The  intensity  of  the  light  radiated  by  a  light  source,  measured  by  candle  power 

•  The  amount  of  light  striking  an  object  from  a  light  source,  known  as  its  illuminance 

•  The  perceived  brightness  of  an  object,  known  as  its  luminance,  which  depends  upon  the 
object's  reflectance 

•  The  difference  between  an  object's  luminance  compared  to  the  luminance  of  the  object's 
background,  or  contrast 

•  The  object's  size 

•  The  individual  worker’s  age  and  visual  acuity. 

Visibility  is  also  affected  by  changes  in  light  levels  as  the  eyes  adapt.  Individuals  have  particular 
difficulty  seeing  while  their  eyes  are  adapting  to  a  different  level  of  illuminance,  such  as  entering 
a  darkened  room  from  full  sunlight. 

The  ability  to  accurately  perceive  colors  (color  discrimination)  is  also  affected  by  lighting. 
Color  discrimination  may  be  reduced  by  the  characteristics  of  the  light  source.  For  example, 
high-pressure  sodium  discharge  lamps  reduce  the  ability  to  discriminate  colors,  while  artificial 
daylight  fluorescent  lamps  maintain  it.  Very  low  lighting  levels  also  adversely  affect  color 
discrimination. 

Glare  and  flicker  will  also  reduce  visual  performance.  Glare  occurs  when  the  luminance  level 
(the  amount  of  light  reflected  from  an  object)  is  annoying.  It  may  reduce  contrast,  interfere  with 
reading  and  inspection  tasks  and  cause  visual  fatigue.  Flicker  causes  discomfort  and  eye  fatigue 
when  reading. 
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16.1.6  Other  Adverse  Task  Conditions 

Other  adverse  environmental  conditions  may  also  affect  task  performance.  In  general,  any 
physical  conditions  that  require  the  use  of  PPE  or  devices  complicate  task  performance,  may  be 
stressful  and  so  may  increase  the  likelihood  of  errors  (see  Section  12,  Tools  and  Equipment.) 

For  example,  working  in  confined  or  elevated  spaces  may  encourage  personnel  to  hurry  through 
their  tasks  and  so  commit  errors.  Working  in  high  radiation  environments  may  require  that  task 
performance  be  repeatedly  interrupted  to  minimize  exposures.  Poor  housekeeping  may  increase 
the  likelihood  of  trips  and  falls,  or  obscure  displays  and  controls.  Working  on  ladders  or 
platforms,  or  in  cramped  working  conditions  that  require  unusual  physical  postures  may  cause 
discomfort,  can  be  distracting  and  may  increase  the  likelihood  of  errors. 

16.1.7  Combinations  of  Conditions 

Most  of  the  research  that  has  examined  the  effects  of  environmental  factors  on  human 
performance  has  been  done  in  the  laboratory  or  in  other  highly  controlled  settings.  In  most 
industrial  settings,  environmental  factors  are  not  as  rigidly  controlled  and  often  fluctuate. 
Further,  in  industry,  adverse  environmental  conditions  often  occur  together,  such  as  high  noise 
levels  and  excessive  heat  when  high-energy  equipment  is  operating.  Large  fluctuations  in 
conditions  and  combinations  of  conditions  have  not  been  as  thoroughly  studied.  There  is  some 
evidence  to  suggest,  however,  that  performance  degradations  are  more  severe  under  fluctuating 
and/or  combined  conditions. 

16.2  DIRECT  CAUSES  OF  TASK  ENVIRONMENT-RELATED  ERRORS 

A  direct  cause  of  a  task  environment  error  describes  the  physical  conditions  that  caused  task 
performance  to  fail.  There  are  a  number  of  ways  in  which  characteristics  of  the  task 
environment  may  impair  performance.  These  include: 

Vibration  -  Task  performance  failed  because  high  levels  of  whole-body  or  object 
vibration  made  displays,  instruments  or  documents  difficult  to  read  or  caused  discomfort. 
For  example,  vibration  prevented  a  worker  from  accurately  reading  a  piping  and 
instrumentation  diagram. 

Noise  -  Task  performance  failed  because  high  noise  levels  interfered  with 
communications,  caused  discomfort,  or  impaired  mental  or  physical  performance. 

Heat  -  Task  performance  failed  because  excessive  exposure  to  heat  caused  discomfort  or 
impaired  mental  or  physical  performance.  Or,  the  need  for  frequent  work  breaks  delayed 
task  completion  or  increased  the  communication  burden  on  personnel  due  to  rotations. 

Cold  -  Task  performance  failed  because  excessive  exposure  to  cold  caused  discomfort  or 
impaired  motor  performance.  For  example,  workers  dropped  tools  or  were  unable  to 
manipulate  controls. 
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Lighting  -  Task  performance  failed  because  lighting  was  excessive,  insufficient,  the 
wrong  type  for  discriminating  color,  or  produced  annoyance  from  glare  or  flicker.  For 
example,  a  computer  screen  was  difficult  to  read  due  to  glare. 

Poor  housekeeping  -  Task  performance  failed  because  displays  or  controls  were  obscured 
by  trash  or  equipment  that  should  have  been  stored.  Workers  tripped  over  or  were 
required  to  walk  out  of  their  way  to  avoid  tools  or  equipment  that  should  have  been 
removed. 

Workspace  -  Task  performance  failed  because  the  worker  had  insufficient  space  to 
perform  the  task  or  had  to  assume  uncomfortable  positions. 

High  radiation  -  Task  performance  failed  because  workers  were  hurried  or  their  activities 
were  repeatedly  interrupted  to  avoid  excessive  exposures. 

Combinations  of  factors  -  Task  performance  failed  because  a  combination  of 
environmental  factors  impaired  performance.  For  example,  a  job  in  the  turbine  building 
involved  exposure  to  heat,  noise  and  low  lighting,  none  of  which  individually  exceeded 
levels  at  which  performance  is  affected,  but  the  combination  of  conditions  distracted  the 
workers  and  caused  errors. 

16.3  PROGRAMMATIC  CAUSES  OF  TASK  ENVIRONMENT  ERRORS 

Programmatic  causes  of  task  environment  errors  are  typically  found  in  the  licensee’s 
processes  for  designing  human-system  interfaces  or  in  managing  maintenance  activities. 

Other  programs  may  also  be  implicated.  Common  programmatic  causes  of  task 
environment  errors  include: 

Industrial  Hygiene  and  Radiation  Protection  -  These  programs  are  responsible  for 
ensuring  that  task  environments  have  been  evaluated  to  identify  hazards  and  that 
needed  controls  are  implemented  to  minimize  exposures.  Weaknesses  in  these 
programs  may  result  in  personnel  working  in  task  environments  that  are  conducive  to 
errors. 

Work  Planning  and  Control  -  Weaknesses  in  the  work  planning  and  control  system  may 
allow  work  to  be  planned  without  consideration  of  adverse  environmental  conditions  and 
performed  without  the  necessary  compensatory  measures.  For  example,  communication 
devices  may  not  be  provided  in  noisy  environments  to  support  task  performance.  For 
tasks  that  involve  unusual  physical  positions  or  cramped  workspace,  additional  time  to 
complete  the  task  may  not  be  scheduled.  Rest  breaks  for  hot  and  cold  environments  may 
not  be  planned  into  the  work,  or  additional  temporary  lighting  may  not  be  provided  if  the 
work  site  is  not  adequately  lighted. 

Procedures  -  Weaknesses  in  the  licensee's  procedure  development  process  may  result  in 
the  design  of  procedures  that  are  inappropriate  for  the  conditions  in  which  they  will  be 
used.  For  example,  procedures  that  may  be  used  at  night,  outside  and  in  the  rain  should 
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be  laminated  and  the  type  size  should  be  larger  to  ensure  the  procedure  can  be  read. 
Procedures  that  will  be  used  in  vibration  conditions  may  also  require  larger  type  size  than 
procedures  read  in  the  stationary  environment  of  the  control  room,  for  example. 

Human  Factors  Engineering  -  Weaknesses  in  the  human  factors  engineering  program 
may  result  in  the  installation  of  new  equipment  or  systems  without  consideration  of 
task  environment  characteristics.  For  example,  the  impact  of  control  room  lighting 
on  the  visibility  of  digital  displays  or  effects  of  vibration  on  the  legibility  of  dials  or 
gauges  at  local  control  stations  should  be  considered  before  installation. 

Operating  Experience  -  Reviews  of  relevant  operating  experiences  of  the  plant  and  other 
facilities  with  similar  environmental  conditions  should  be  conducted  to  identify  and 
analyze  task  environment  problems  and  successful  mitigation  efforts.  Personnel  may 
have  reported  task  environment  conditions  that  interfered  with  performance  that  are 
recorded  in  the  licensee’s  corrective  action  database,  and  corrective  actions  should  have 
been  implemented.  Weaknesses  in  this  program  will  result  in  repeated  errors. 

Labeling  -  Weaknesses  in  this  program  may  result  in  tags  and  plaques  that  are  illegible  in 
the  task  environment,  if  low  lighting  levels  or  vibration  are  present. 

16.4  ADDITIONAL  RESOURCES  ON  TASK  ENVIRONMENTS 

•  U.S.  Nuclear  Regulatory  Commission  (1992).  Shutdown  and  low-power  operation  at 
commercial  nuclear  power  plants  in  the  United  States  (NUREG-1449).  Washington, 

DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1996).  Human-system  interface  design  review 
guideline  (NUREG-0700,  Rev.  1,  Vol.s  1-3).  Washington,  DC:  U.S.  Nuclear  Regulatory 
Commission. 

•  Echeverria,  D.,  Barnes,  V.,  Bittner,  A.,  Durbin,  N.,  Fawcett-Long,  J.,  Moore,  C.,  Slavich, 
A.  Terrill,  B.,  Westra,  C.,  Wieringa,  D.,  Wilson,  R.,  Draper,  D.,  Morisseau,  D.  and 
Persensky,  J.  (1994).  The  impact  of  environmental  conditions  on  human  performance:  A 
handbook  of  environmental  exposures  (NUREG/CR-5680,  Vol.s  1  and  2).  Washington, 
DC:  U.S.  Nuclear  Regulatory  Commission. 
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17  COMMUNICATIONS 


17.1  COMMUNICATIONS  IN  ORGANIZATIONS 

Communication  is  the  exchange  of  information  while  preparing  for  or  performing  work.  Verbal 
communication  occurs  face-to-face,  by  telephone,  sound-powered  phones  or  walkie-talkies,  as 
well  as  over  public  address  systems.  Written  communication  occurs,  for  example,  through 
policies,  standards,  work  packages,  training  materials,  and  e-mail. 

Communication  involves  two  sets  of  behaviors:  (1)  creating  and  sending  messages  and  (2) 
receiving  and  interpreting  them.  Communication  always  involves  at  least  two  individuals,  the 
sender  and  the  receiver,  and  occurs: 

•  Between  individuals 

•  Within  and  among  work  groups 

•  In  meetings 

•  In  pre-job  or  pre-evolution  briefings 

•  During  shift  turnover 

Successful  communication  requires  several  steps.  The  sender  first  develops  the  intention  to 
communicate  either  verbally  or  in  writing.  The  sender  then  composes  a  message  that  presents 
the  meaning  as  clearly  as  possible.  The  receiver  must  pay  attention  to  the  message  and  then 
interpret  its  meaning.  If  the  communication  is  successful,  the  receiver  interprets  the  message 
consistently  with  the  sender’s  intended  meaning. 

The  similarity  of  the  meanings  given  to  the  message  by  the  sender  and  receiver  can  be  verified 
through  feedback.  An  example  of  feedback  verification  in  verbal  communication  is  when  the 
receiver  "repeats  back”  the  message  and  the  sender  either  agrees  with  the  receiver’s  repeat  back 
or  corrects  it.  Verification  feedback  serves  an  important  error-checking  function  in  the 
communication  process.  It  also  allows  supervisory  oversight  of  communications  to  catch  errors 
before  they  have  consequences. 

A  sender  and  receiver  must  both  be  active  for  communication  to  be  effective.  The  sender  and 
receiver  share  responsibility  for  ensuring  successful  communication.  However,  when  licensees 
analyze  the  causes  of  events,  errors  in  sending  messages  are  more  often  identified  than  errors  in 
receiving.  The  reasons  for  the  difference  are  unclear.  A  licensee’s  investigation  should  consider 
sending  and  receiving  errors  and  corrective  actions  should  address  both  to  be  effective. 

17.2  DIRECT  CAUSES  OF  COMMUNICATIONS-RELATED  ERRORS 

A  direct  cause  of  a  communication  error  describes  the  characteristics  of  the  communication  that 
caused  it  to  fail.  The  direct  cause  of  the  error  may  be  characteristics  of  how  the  message  was 
sent  or  how  it  was  received  and  interpreted.  In  some  cases,  a  communication  error  will  be 
compounded  by  failures  in  verification  feedback  or  supervisory  oversight. 
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There  are  a  number  of  ways  in  which  communication  can  fail.  Research  regarding 
communication  errors  in  nuclear  licensee  facilities  identified  eleven  direct  causes  of  sending  and 
five  direct  causes  of  errors  in  receiving: 

17.2.1  Sending  Errors 

Content  wrone  -  Communication  failed  because  the  information  contained  in  the  message 
was  incorrect.  For  example,  an  operator  in  the  control  room  refers  to  the  wrong  unit 
when  giving  instructions  to  an  operator  in  the  field. 

Content  inconsistent  -Communication  failed  because,  although  the  information  in  a 
message  was  correct,  it  was  partially  or  completely  inconsistent  with  other  information 
available  to  the  receiver.  For  example,  a  required  surveillance  test  appears  on  a 
maintenance  worker’s  schedule  but  his  supervisor  assigns  him  to  another  job  and  the 
surveillance  is  missed. 

Content  inappropriate  for  the  job  -  Communication  failed  because  the  information  in  a 
message  was  irrelevant  or  inappropriate  for  the  job  at-hand.  For  example,  a  work  order 
references  a  procedure  that  contains  prerequisite  conditions  that  cannot  be  met  during  at- 
power  operations,  but  the  maintenance  worker  attempts  to  perform  the  procedure 
anyway. 

Content  inappropriate  for  the  receiver  -  Communication  failed  because  the  message  was 
not  tailored  to  the  receiver’s  background,  training  or  level  of  technical  knowledge.  For 
example,  a  non-licensed  operator  is  instructed  to  perform  a  task  on  an  unfamiliar  system 
and  cannot  find  it. 

Standard  terminology  not  used  -  Communication  failed  because  complete  identification 
information  was  not  provided  in  the  message.  For  example,  a  maintenance  supervisor 
refers  to  a  valve  using  a  generic  pronoun  (e.g.,  "it"),  rather  than  using  the  valve’s  proper 
name  and  number,  and  the  maintenance  crew  works  on  the  wrong  valve. 

Familiar  terminology  not  used  -  Communication  failed  because  unfamiliar  terms  were 
used  in  the  message.  For  example,  the  formal  name  of  a  building,  rather  than  the  site- 
specific  nickname,  is  used  in  a  pre-job  briefing  and  the  crew  is  confused  about  which 
building  is  being  discussed. 

Message  production  inadequate  -  Communication  failed  because  the  message  was  not 
produced  adequately.  For  example,  a  message  is  garbled  when  transmitted  over  the 
public  address  system  or  cannot  be  heard  against  background  noise.  A  written 
communication  contains  typographical  errors  or  copies  are  illegible. 

Necessary  information  not  sent  -  Communication  failed  because  the  information  needed 
to  perform  a  task  was  not  provided  to  the  worker.  For  example,  a  work  order  omits  an 
instruction  to  obtain  control  room  authorization  before  taking  the  component  out  of 
service. 
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Wrong  place  or  person  -  Communication  failed  because  necessary  information  did  not 
reach  the  intended  receiver.  For  example,  a  sender  dials  the  wrong  phone  number  or 
incorrectly  addresses  an  e-mail  message. 

Wrong  time  -  Communication  failed  because  the  message  was  sent  too  early  or  too  late  to 
be  used  by  the  receiver.  For  example,  a  maintenance  worker  finishes  one  job  early  and 
starts  on  the  next  before  her  supervisor  has  the  opportunity  to  communicate  that  the  job 
has  been  rescheduled. 

Sending  verification  failure  -  Communication  failed  because  the  sender  did  not  ensure 
that  the  receiver  accepted  and  accurately  interpreted  the  message.  For  example,  a  non- 
licensed  operator  calls  the  control  room  to  report  a  leak  and  can  tell  that  the  control  room 
operator  is  busy  and  distracted,  so  does  not  request  that  the  control  room  operator  repeat 
back  the  location  and  rate  of  the  leak. 

17.2.2  Receiving  Errors 

Information  not  sought  -  Communication  failed  because  a  receiver  did  not  seek  the 
information  necessary  to  perform  a  task.  For  example,  a  work  order  references  drawings 
needed  to  verify  the  location  of  a  component,  but  the  planner  does  not  include  them  in  the 
work  package  and  maintenance  technicians  do  not  obtain  and  review  them  before  starting 
work. 

Information  not  found  -  Communication  failed  because  the  receiver,  intentionally  or 
unintentionally,  did  not  find  necessary  information  for  performing  a  task.  For  example, 
an  identification  tag  on  a  cable  is  hidden  and  the  crew  decides  to  perform  the  task  without 
positively  identifying  the  cable  referenced  in  the  work  package,  resulting  in  errors. 

Information  not  used  -  Communication  failed  because  the  information  necessary  to 
perform  a  task  was  not  used.  For  example,  the  need  to  wear  electrical  safety  PPE  is 
discussed  at  a  pre-job  briefing,  but  the  instrumentation  and  control  technician  is  in  a 
hurry  and  performs  the  task  without  it. 

Message  misunderstood  -  Communication  failed  because  the  receiver  misunderstood  the 
message.  For  example,  a  control  room  supervisor  and  an  operator  discuss  two  related 
jobs,  one  of  which  requires  establishing  a  fire  watch.  In  the  course  of  the  discussion,  the 
operator  becomes  confused  about  which  job  requires  the  fire  watch  and  establishes  the 
watch  for  the  wrong  job. 

Receiving  verification  failure  -  Communication  failed  because  the  receiver  did  not  take 
actions  to  test  his  or  her  understanding  of  the  message  received.  For  example,  the  control 
room  operator  in  the  fire  watch  example  failed  to  repeat  back  or  paraphrase  the 
supervisor’s  message  to  check  concurrence  and  to  identify  any  gaps  in  the  message  or  in 
his  understanding  of  it. 
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17.3  PROGRAMMATIC  CAUSES  OF  COMMUNICATIONS-RELATED  ERRORS 


Most  work  activities  in  organizations  require  coordination  within  and  among  work  groups. 
Coordination  requires  effective  verbal  and  written  communication.  Communication  is  necessary 
to  define  the  work  to  be  done  and  how  to  do  it,  so  communication  errors  are  frequently  found  to 
be  causal  factors  in  events.  But,  because  so  many  work  activities  depend  on  effective 
communication,  a  wider  variety  of  programmatic  causes  are  associated  with  communication 
errors  than  with  other  types  of  human  errors. 

Programmatic  causes  that  have  been  shown  to  cause  or  contribute  to  communication  errors  at 
nuclear  licensee  facilities  are  described  below.  Weaknesses  in  other  programs  at  a  licensee’s  site 
may  also  cause  communication  errors. 

Information  management  -  Flaws  in  programs  for  developing  and  managing  technical 
documentation  are  a  common  source  of  communication  errors.  Omissions  and  technical 
inaccuracies  in  vendor  manuals,  engineering  analyses,  design  basis  or  other  reference 
documents  may  be  translated  into  inaccuracies  in  procedures  and  work  orders  that  are 
used  to  perform  jobs.  Failures  to  update  drawings  and  procedures  when  new  hardware  is 
installed  or  existing  hardware  is  modified  can  result  in  communication  errors. 

Work  Planning  and  Control  -  Planning  and  scheduling  maintenance  activities  is  a 
complex  task.  Weaknesses  in  work  planning  and  control  programs  may  result  in  both 
written  and  verbal  communication  errors  associated  with,  for  example,  inadequate  work 
orders,  inadequate  pre-job  briefings,  or  communication  failures  during  job  performance. 

Shift  Staffing  -  Insufficient  staffing  can  increase  the  workload  for  those  performing  a  job, 
and  so  interfere  with  required  communications.  Increased  workload  during  plant  outages 
and  the  increased  numbers  of  workers  on-site,  or  increased  workload  during  off-normal 
events,  can  tax  the  supervisory  abilities  of  those  responsible  for  coordinating  the  work, 
resulting  in  incomplete  or  too  few  communications.  Too  many  staff  involved  in 
performing  a  job  can  increase  the  communication  burden  on  all  involved  and  result  in 
communication  failures. 

Training  -  Effective  communication  requires  some  degree  of  shared  understanding  of  the 
work  to  be  performed.  Inadequate  job  knowledge,  resulting  from  deficient  training  or 
qualifications,  can  lead  to  both  sending  and  receiving  errors.  Effective  communication 
also  depends  upon  an  understanding  of  the  information  needs  of  those  involved  in 
performing  a  job.  Communication  across  organizational  boundaries  (e.g.,  between 
individuals  in  different  departments,  in  different  job  roles,  or  on  different  shifts)  can 
cause  problems  because  senders  and  receivers  may  not  understand  one  another’s 
terminology  or  the  contexts  and  constraints  of  the  other’s  job. 

Procurement  and  Maintenance  -  Some  communications  occur  across  physical  distances 
through  communication  devices.  Procurement  and  maintenance  programs  ensure  that 
communication  devices  are  suitable  for  their  intended  uses  and  are  working  properly. 
Communication  errors  can  arise  here,  for  example,  when  there  is  too  much  background 
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noise  for  a  receiver  to  hear  a  public  address  announcement  or  what  is  being  said  on  the 
radio  or  over  the  telephone.  An  insufficient  number  of  radio  frequencies  to  support 
communication  needs  may  also  cause  or  contribute  to  communication  errors. 

Supervision  -  Some  communication  failures  occur  as  a  result  of  human  errors  in  job 
performance.  These  errors  can  often  be  caught  and  corrected  through  independent 
observation  and  supervisory  oversight  of  the  work  being  done.  Weaknesses  in  plant 
programs  for  deciding  which  jobs  require  independent  oversight  or  for  ensuring  that 
appropriate  supervision  is  available  to  watch  for  errors  can  allow  communication  errors 
to  occur. 

Procedures  -  Lack  of  communication  skills  or  failure  to  apply  standard  verbal  and  written 
communication  practices  are  often  associated  with  communication  errors.  A  lack  of 
training  in  standard  communication  techniques  and  the  absence  of  procedures  to 
prescribe  the  circumstances  in  which  standard  communication  techniques  will  be  used 
often  contribute  to  the  occurrence  of  errors. 

17.4  ADDITIONAL  RESOURCES  ON  COMMUNICATIONS 

•  U.S.  Nuclear  Regulatory  Commission  (1996).  Human-system  interface  design  review 
guideline  (NUREG-0700,  Rev.  l,Vol.sl-3).  Washington,  DC:  U.S.  Nuclear  Regulatory 
Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1997).  Evaluation  criteria  for  communications- 
related  corrective  action  plans  (NUREG-1545).  Washington,  DC:  U.S.  Nuclear 
Regulatory  Commission. 
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18  COORDINATION  AND  CONTROL 


Note  that  the  structure  of  this  module  differs  from  the  others  and  does  not  include  a  section 
discussing  direct  causes  of  errors  associated  with  coordination  and  control.  Errors  do  not 
typically  result  directly  from  weaknesses  in  coordination  and  control  at  licensee  sites.  Rather, 
coordination  and  control  processes,  along  with  other  programs,  policies  and  processes,  are 
responsible  for  establishing  and  maintaining  a  licensee’s  barriers  to  error.  Therefore,  in  most 
events,  there  will  be  elements  of  coordination  and  control  processes  that  failed  to  prevent  the 
error  from  occurring.  However,  the  element  of  coordination  and  control  that  failed  is  typically 
insufficient  to  cause  the  error  by  itself  and  so  serves  as  a  contributing,  rather  than  direct  cause  of 
an  error. 

18.1  COORDINATION  AND  CONTROL:  SETTING  THE  STAGE  FOR  ERRORS 

Control  can  be  defined  as  ensuring  that  work  activities  at  a  site  have  the  intended  results  and  no 
others.  Maintaining  control  requires  that: 

•  The  desired  consequences  of  a  work  activity  are  known  in  advance 

•  The  risks  and  hazards  inherent  in  the  activity  are  known  and  addressed 

•  The  external  conditions  that  increase  the  risks/hazards  of  the  activity  are  known  and  can 
be  controlled,  and 

•  The  activity  is  coordinated  with  other  work  activities  so  that  they  do  not  interfere  with 
one  another  and  the  combination  of  activities  does  not  create  an  unexpected  plant  state. 

Operations  are  controlled  at  a  licensee  facility  when  work  activities  are  routinely  conducted 
without  surprises. 

There  are  three  elements  necessary  to  maintain  operational  control: 

•  Administrative  processes  that  formalize  activities  commensurate  with  their  risk  impact 
and  complexity. 

•  Effective  methods  of  coordinating  the  activities  of  diverse  work  groups  within  the 
organization  as  well  as  the  activities  of  individuals  within  work  groups. 

•  Information  management  to  capture,  communicate  and  retain  important  information  over 
time  and  changes  in  equipment  and  personnel. 

These  elements  ensure  that  an  organization  has  the  tools  required  to  establish  and  maintain 
control  over  maintenance,  engineering  and  plant  operational  activities.  They  are  also  the 
hallmark  of  a  reliable  organization. 

18.1.1  Work  Control 

The  first  element  of  control  includes  the  administrative  processes  by  which  work  is 
conceptualized,  reviewed,  approved,  authorized  and  performed.  Licensees  have  adopted  a 
variety  of  programs  to  structure  the  manner  in  which  work  is  to  be  performed.  Often  the  names 
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and  terminology  of  the  processes  are  different  at  different  sites.  However,  there  are  some 
fundamental  characteristics  of  effective  administrative  work  control  processes  that  should  be 
incorporated  into  the  individual  programs. 

The  control  process  involves  a  series  of  steps  that  define  how  work  activities  in  maintenance, 
engineering  and  operations  are  accomplished  to  ensure  that  management  expectations  are  met. 
These  steps  include: 

1.  Requirement  determination  -  the  decision  to  perform  the  activity 

2.  Development  -  work  design  and  preparation  of  the  procedures  or  work  package 

3.  Approval  -  supervisory  review  of  the  work  plan 

4.  Authorization  -  approval  to  perform  the  work  after  consideration  of  conditions 

5.  Implementation  -  performing  the  work  or  activity 

6.  Oversight  -  supervisory  review  of  the  work  or  activity  including  QA/QC 

7.  Closeout  -  review  of  documentation  and  acceptance  of  quality  of  work 

Effective  work  control  requires  the  selection  of  an  appropriate  level  of  formality,  deliberateness 
and  precision  for  each  step  in  the  process.  The  level  of  formality  must  be  commensurate  with  the 
risk,  complexity  and  importance  of  the  activity.  Greater  degrees  of  formality  ensure  higher 
levels  of  performance  and  quality  at  the  cost  of  additional  time  and  resources.  Typically,  the 
greater  potential  risk,  complexity  or  economic  importance  of  an  activity,  the  greater  the  formality 
in  planning  and  implementing  the  work.  For  more  complex  or  important  jobs,  licensee 
administrative  processes  may  require  more  extensive  reviews  of  work  plans,  higher  levels  of 
management  involved  in  approving  the  plans  and  authorizing  the  start  of  work,  increased 
oversight  of  the  work  as  it  is  being  performed  and  more  thorough  testing  and  evaluation  prior  to 
job  close-out. 

Another  significant  aspect  of  operational  control  is  the  preplanning  that  must  be  accomplished  in 
order  to  allow  simple  evolutions  to  be  performed  with  a  reasonable  level  of  effort  and  to  allow 
rapid  and  correct  action  to  be  taken  when  off-normal  or  emergency  conditions  occur.  An 
example  of  this  preplanning  may  be  observed  in  the  control  room  when  an  operator  must  respond 
to  an  annunciator.  In  this  case,  plant  management  has  predetermined  that  the  operator  can 
invoke  the  annunciator  response  procedure  and  take  the  necessary  actions  without  further 
planning  or  control  steps.  The  operator  has  achieved  a  level  of  mastery  that  qualified  him  or  her 
to  respond  to  the  annunciator  without  further  management  involvement.  The  annunciator 
response  procedure  has  been  verified  and  validated  in  advance  to  ensure  that  the  procedure  will 
address  the  alarm  condition.  However,  each  of  the  seven  steps  in  the  control  process  is  still 
applicable  and  invoked  by  management  decisions,  many  of  which  were  made  long  before  the 
annunciator  alarmed  and  the  operator  took  action  to  respond  to  the  condition. 

Administrative  processes  are  also  required  to  address  unanticipated  conditions.  Even  with 
extensive  preplanning,  conditions  often  arise  that  deviate  from  those  specified  or  assumed  in  a 
work  plan  when  it  is  implemented.  Clear  delineation  of  roles,  responsibilities  and  authorities  is 
necessary  for  personnel  to  understand  the  types  of  unexpected  situations  in  which  they  are 
authorized  to  make  decisions,  resolve  problems  or  to  change  work  plans  to  address  existing 
conditions.  Clear  assignment  of  authority  to  stop  work  when  unexpected  conditions  arise  is  also 
necessary  to  maintain  control.  Changes  to  work  plans  that  have  not  been  analyzed  and  approved 
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by  individuals  who  are  qualified  to  evaluate  the  implications  of  the  changes  are  a  common  cause 
of  errors  at  licensee  facilities. 

18.1.2  Coordination 

Coordination  is  the  process  by  which  resources  (people,  equipment,  tools,  procedures,  parts, 
facilities)  are  identified,  scheduled  and  assigned  to  a  work  activity.  The  scope  of  work  activities 
may  range  from  station-wide  projects  (such  as  steam  generator  replacements)  to  individual  tasks 
(such  as  drafting  a  work  order)  and  the  time  frames  in  which  the  work  occurs  may  range  from 
minutes  to  years. 

Effective  performance  requires  coordination  at  two  organizational  levels.  The  activities  of 
different  organizational  units  (e.g.,  maintenance,  operations,  engineering,  and  subgroups  within 
those  departments)  must  be  coordinated,  and  the  activities  of  individuals  within  work  groups 
(e.g.,  control  room  or  maintenance  crews)  must  be  coordinated  when  more  than  one  individual  is 
assigned  to  a  task.  In  general,  the  licensee’s  managers  and  work  planning  and  scheduling 
processes  coordinate  work  activities  between  organizational  units.  First-line  supervision  is 
typically  responsible  for  coordinating  the  activities  of  individuals  and  teams  within  a  department. 

In  general,  the  goals  of  coordination  are  to  ensure  that: 

•  work  activities  are  planned  and  scheduled  so  that  they  do  not  interfere  with  one  another 

•  the  combination  of  activities  occurring  concurrently  does  not  create  unexpected, 
unknown  or  unanalyzed  conditions 

•  the  necessary  resources  required  to  perform  a  task  are  available  to  perform  the  task  when 
required  (e.g.,  necessary  tools,  parts  and  equipment,  procedures,  sufficient  numbers  of 
qualified  personnel) 

•  the  work  will  be  completed  on  time. 

Coordination  methods  range  from  highly  complex,  detailed  and  formalized  interactive  software 
planning  tools  to  simple  “to  do”  lists.  The  licensee  will  often  require  the  use  of  several  different 
scheduling  tools  or  methods  in  station  administrative  procedures  for  different  types  of  work 
activities.  For  example,  most  licensees  typically  use  interactive,  real  time,  critical  path  planning 
software  to  coordinate  outage  work  activities.  However,  they  often  use  less  formalized  planning 
and  scheduling  tools  for  the  daily,  at-power  operations  and  other  internal  departmental  activities. 
In  each  case,  the  elements  of  a  successful  coordination  process  are  consistent  with  the 
complexity  and  the  risk  significance  of  the  activity. 

Work  planning  determines  the  specific  human  performance  elements  that  are  necessary  for  each 
work  package  or  job  and  ensure  that  they  are  available  and  integrated.  Human  performance 
elements  required  to  conduct  a  specific  job  may  include  requirements  for  communication, 
procedures,  skilled  personnel,  documentation,  supervisory  oversight,  quality  assurance,  special 
tools  and  equipment  or  other  resources. 

An  example  of  a  coordination  error  would  be  a  fuel  rod  placed  into  the  wrong  position  because 
the  refueling  operator  did  not  obtain  independent  verification  of  correct  grid  position  prior  to 
lowering  the  assembly  into  the  core.  Clearly,  an  error  of  this  type  could  also  result  from  the 
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operator’s  inability  to  select  the  correct  grid  position  in  the  core  or  skipping  the  step  in  the 
procedure  that  required  independent  verification.  However,  if  the  refueling  procedure  did  not 
require  independent  verification  of  the  grid  position  prior  to  lowering  the  assembly,  or  no  one 
was  available  to  perform  the  verification  even  though  the  operator  might  otherwise  have  waited 
for  it  to  be  verified  before  proceeding,  the  cause  of  the  error  would  lie  in  coordination. 

The  most  common  consequences  of  weaknesses  in  coordination  are  that  work  is  delayed.  For 
example,  a  maintenance  crew  may  have  to  stop  a  job  for  two  hours  while  waiting  for  a  quality 
control  (QC)  inspector  to  be  available.  Or,  work  on  a  piece  of  equipment  cannot  start  on  time 
because  the  tags  were  not  hung  by  the  previous  shift.  Delays  typically  affect  productivity  rather 
than  cause  errors.  However,  the  likelihood  of  errors  increases  if  plant  conditions  change  during 
the  delay  so  that  the  work  plan  can  no  longer  be  implemented  as  written,  or  if  the  job  must  be 
extended  over  more  than  one  shift  and  important  information  is  not  communicated  during  shift 
change. 

18.1.3  Information  Management 

The  third  element  necessary  to  effective  control  is  the  information  management  systems  that 
capture,  communicate  and  maintain  important  information  that  is  required  to  conduct  work 
activities  safely.  The  organization  identifies  information  that  will  be  required  to  safely  and 
effectively  operate  or  repair  the  plant,  disseminates  it  and  maintains  this  information  to  assure 
that  it  can  be  accessed  when  required.  The  type  of  information  to  be  managed  includes  such 
diverse  areas  as  operations  configuration  control  of  equipment  alignments,  engineering  design 
control  of  systems  and  components,  quality  assurance  of  spare  parts,  and  quality  control  of 
nondestructive  testing.  In  each  case,  the  information  required  to  safely  operate  or  maintain  the 
equipment  must  be  identified,  captured,  retained  and  made  readily  available  as  the  plant 
personnel  change  over  time.  This  process  includes  configuration  management  of  short-term 
equipment  alignments  to  ensure  compliance  with  technical  specifications  as  well  as  long-term 
engineering  design  control  changes  that  may  impact  the  plant  safety  envelope  over  the  life  of  the 
reactor. 

Identification  of  important  information  is  a  dynamic  process.  As  new  conditions  and  events 
occur,  information  requirements  will  change.  For  example,  industry  codes  and  standards  may  be 
updated.  Information  may  become  available  from  Significant  Operational  Events  Reviews 
(SOERs),  licensee  reports  to  the  NRC  and  lessons  learned  from  NRC  inspection  activities  that 
should  be  disseminated  and  retained.  Changes  in  the  workforce  at  a  site  may  also  require  that 
more  or  different  types  of  information  be  made  available  to  new  personnel. 

An  example  of  a  human  error  related  to  information  management  would  be  if  a  vendor 
determined  that  a  certain  preventive  maintenance  action  was  required  and  the  plant  maintenance 
staff  did  not  have  an  active  vendor  manual  program  to  identify  the  change  and  incorporate  this 
preventive  maintenance  item  into  the  plant’s  schedule.  The  result  was  a  component  that  failed 
because  a  process  had  not  been  adequately  established  to  update  the  vendor  manuals. 
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18.2  EFFECTS  OF  COORDINATION  AND  CONTROL  WEAKNESSES 


The  following  are  examples  of  ways  in  which  coordination  and  control  may  set  the  stage  for 
other  performance  shaping  factors  to  cause  errors. 

18.2.1  Work  Control 

Requirements  not  identified  or  incomplete  -  The  risks  and  hazards  associated  with  the 
work  activity  were  not  identified  or  were  identified  incompletely.  For  example, 
applicable  standards  and  codes  were  not  reviewed  or  the  job  site  was  not  walked  down 
prior  to  developing  the  work  plan.  As  a  result,  controls  for  the  risks/hazards  were  not 
incorporated  into  the  work  plan. 

Work  planning  informal  -  The  degree  of  deliberateness,  formality  and  thoroughness  in 
work  planning  and  preparation  was  not  commensurate  with  the  risks/hazards  the  work 
entailed.  For  example,  a  work  package  was  not  developed  for  the  job  or  was  incomplete, 
resource  requirements  were  not  analyzed  in  advance,  or  timing  requirements  were  not 
identified.  As  a  result,  the  resources  required  to  complete  the  work  on  time  and  safely 
were  not  available. 

Approval  process  inadequate  -  Review  and  approval  of  the  work  plan  was  weak.  For 
example,  personnel  not  qualified  to  evaluate  it  reviewed  the  work  plan,  not  all  of  the 
affected  work  groups  reviewed  the  plan,  or  approval  was  not  obtained  or  was  obtained 
from  an  individual  without  the  authority  to  do  so.  As  a  result,  missing  or  conflicting 
elements  in  the  work  plan  were  not  identified  or  risk  implications  of  the  work  were  not 
identified  and  addressed. 

Authorization  inadequate  -  Authorization  to  begin  the  work  was  not  obtained  or  was 
obtained  on  the  basis  of  conditions  that  had  changed  or  ceased  to  exist  by  the  time  the  job 
started.  For  example,  despite  requirements  documented  in  procedures,  taught  in  training 
and  communicated  as  management  expectations,  an  instrumentation  and  control 
technician  did  not  call  the  control  room  for  permission  to  power  down  a  controller  for 
testing.  Or,  a  control  room  operator  determined  that  another  emergency  operating 
procedure  was  applicable  to  the  circumstances  and  began  implementing  it  without 
authorization  from  the  unit  supervisor. 

Implementation  not  controlled  -  The  work  was  planned,  approved  and  authorized,  but 
was  not  performed  in  accordance  with  the  work  plan.  For  example,  individuals  without 
the  proper  authority  changed  the  plan  to  accommodate  unexpected  circumstances. 

Oversight  inadequate  -  The  amount  or  type  of  oversight  of  the  work,  including 
management,  supervision  or  QA/QC,  was  less  than  the  risks  and  hazards  of  the  work 
warranted.  As  a  result,  for  example,  decisions  were  made  without  adequate  authorization 
or  errors  were  not  caught  and  corrected. 


18-5 


Closeout  inadequate  -  Documentation  of  the  job  was  not  completed  or  was  completed 
incorrectly,  required  tests  were  not  performed,  lessons  learned  were  not  identified  and 
communicated.  As  a  result,  for  example,  equipment  was  left  in  an  inoperable  condition 
following  maintenance. 

18.2.2  Coordination 

Job  conflicts  -  Work  activities  were  scheduled  in  a  manner  that  caused  them  to  interfere 
with  one  another.  For  example,  due  to  schedule  slippage,  two  jobs  were  scheduled  to 
work  on  the  same  component  on  the  same  shift. 

Job  combinations  -  Work  activities  that  were  scheduled  concurrently  had  unanticipated 
and  adverse  consequences.  For  example,  a  component  was  taken  out  of  service  that 
operators  needed  to  complete  a  scheduled  tech  spec  surveillance.  Or,  all  trains  of  safety 
system  were  inadvertently  disabled  at  the  same  time. 

Resources  unavailable  -  The  resources  required  to  perform  a  job  were  not  scheduled  to 
be  available  when  needed.  For  example,  the  same  health  physics  technician  was  assigned 
to  monitor  two  jobs  concurrently  on  different  units.  Or,  tools  and  equipment  required  for 
a  job  were  in  use  on  another  job  when  needed. 

Work  untimely  -  Work  activities  or  work  products  were  not  available  when  needed.  For 
example,  new  drawings  that  were  required  to  finish  planning  a  construction  job  were 
three  weeks  late  in  being  delivered  from  the  engineering  department. 

18.2.3  Information  Management 

Documentation  missing  -  Required  information  was  not  obtained  or  was  not  accessible 
when  needed.  For  example,  reference  documentation  needed  to  develop  a  new  procedure 
had  not  been  purchased  from  the  vendor  or  could  not  be  located. 

Documentation  inaccurate  -  Information  about  equipment,  drawings,  valve  lists,  or 
design  basis  documents,  for  example,  was  out-of-date  or  wrong.  As  a  result,  work 
packages  were  incomplete,  procedures  were  incomplete  or  inaccurate,  or  training  did  not 
address  required  KSAs. 

18.3  ADDITIONAL  RESOURCES  ON  COORDINATION  AND  CONTROL 

•  U.S.  Code  of  Federal  Regulations,  Part  50.65,  Requirements  for  monitoring  the 
effectiveness  of  maintenance  at  nuclear  power  plants,  Title  10,  Energy  (revised 
periodically).  Washington,  DC:  U.S.  Government  Printing  Office. 

•  U.S.  Code  of  Federal  Regulations,  Appendix  B  to  Part  50,  Quality  assurance  criteria  for 
nuclear  power  plants  and  fuel  reprocessing  plants.  Title  10,  Energy  (revised  periodically). 
Washington,  DC:  U.S.  Government  Printing  Office. 
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•  U.S.  Nuclear  Regulatory  Commission  (1978).  Quality  assurance  program  requirements 
(Operation)  (Regulatory  Guide  1.33,  Rev.  2).  Washington,  DC:  U.S.  Nuclear 
Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1997).  Monitoring  the  effectiveness  of 
maintenance  at  nuclear  power  plants  (Regulatory  Guide  1.160,  Rev.  2).  Washington, 
DC:  U.S.  Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (1985).  Quality  assurance  program  requirements 
for  nuclear  power  plants  (Regulatory  Guide  1.28,  Rev.  3).  Washington,  DC:  U.S. 
Nuclear  Regulatory  Commission. 

•  U.S.  Nuclear  Regulatory  Commission  (2000).  Assessing  and  managing  risk  before 
maintenance  activities  at  nuclear  power  plants  (Regulatory  Guide  1 . 1 82).  Washington, 
DC:  U.S.  Nuclear  Regulatory  Commission. 
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Glossary  of  Terms 


An  ability  is  the  combination  of  knowledge  and  skill  required  to  perform  a  task  correctly. 

An  alarm  system  is  an  automated  system  consisting  of  processing  and  display  hardware 
and  software,  which  processes  or  analyzes  signals  from  plant  sensors  and  alerts  the 
operator  via  visual  and/or  auditory  displays  when  monitored  parameters  deviate  from 
specified  limits  (setpoints). 

A  barrier  is  any  means  used  to  protect  personnel  and  equipment  from  hazards.  There  are 
two  types:  physical  and  management  barriers.  Examples  of  physical  barriers  are  fences, 
guard  rails  around  moving  equipment,  protective  clothing  and  safety  devices,  or  shields. 
Examples  of  management  barriers  are  risk  and  hazard  analyses,  supervision,  training,  or 
procedures. 

Barrier  analysis  is  a  root  cause  analysis  method.  It  is  performed  once  the  basic  facts  of 
an  event  or  human  performance  problem  are  understood  and  asks  the  question,  “What 
physical  or  management  barriers  could  have  prevented  this  event  or  problem  from 
occurring?” 

A  causal  factor  is  any  action  or  condition  that  occurred  or  existed  prior  to  the  initiation 
of  an  event  and  without  which  the  event  may  not  have  occurred.  The  term  "causal  factor" 
is  synonymous  with  the  term  "cause,"  and  may  refer  to  direct,  contributing,  programmatic 
or  root  causes. 

Circadian  rhythms  are  also  known  as  “biological  clocks”  and  are  patterns  in 
physiological  functioning  over  the  course  of  a  day. 

Cognitive  performance  refers  to  mental  activities  and  includes  perception,  interpretation, 
judgment  and  decision-making. 

A  communication  error  is  a  failure  in  the  exchange  of  information  between  a  sender  and 
receiver,  in  which  the  receiver  fails  to  receive  or  interpret  a  message  consistently  with  the 
sender's  intended  meaning.  The  failure  can  occur  in  creating  and  sending  messages  or  in 
receiving  and  interpreting  them. 

Communication  systems  are  physical  systems  that  support  communications,  such  as 
between  personnel  in  the  main  control  room,  between  the  main  control  room  and  local 
sites  within  the  plant,  and  across  sites  within  the  plant.  The  broad  variety  of 
communication  media  may  be  generally  categorized  as  speech-based  and  computer-based 
systems. 

Computer-based  procedure  system  present  plant  procedures  in  computer-based,  rather 
than  paper-based,  formats. 


Computerized  operator  support  systems  use  computer  technology  to  support  operators 
or  maintenance  personnel  in  situation  assessment  and  response  planning.  They  can 
monitor  status  and  provide  recommendations  or  warnings. 

A  test  has  content  validity  if  the  test  items  are  directly  related  to  job  performance  by 
ensuring  they  match  the  instructional  objectives  and  are  appropriately  weighted. 

A  control  is  a  mechanism  used  to  regulate,  and/or  guide  the  operation  of  a  component, 
equipment,  subsystem,  or  system. 

A  contributing  cause  is  an  action  or  condition  that  sets  the  stage  for  the  event  to  occur. 

A  contributing  cause  may  be  a  long-standing  condition  or  a  series  of  prior  events  that, 
while  unimportant  in  themselves,  increase  the  probability  that  the  event  would  occur. 

A  corrective  action  is  an  action  authorized  by  and  under  the  control  of  management 
intended  to  solve  problems  identified  as  the  result  of  an  event  investigation.  Effective 
corrective  actions  for  an  event  prevent  the  recurrence  of  the  same  or  a  similar  event. 

A  causal  analysis  is  a  systematic  method  for  evaluating  the  evidence  gathered  about  an 
event  from  an  event  investigation.  The  purpose  of  a  causal  analysis  is  to  identify  the  basic 
set  of  actions  and  conditions  that,  if  eliminated  or  modified,  would  prevent  the  same 
event  and  similar  events  from  happening  again. 

A  cursor  is  a  display  graphic  that  is  used  to  indicate  the  position  of  the  user’s  operation 
on  the  display  (such  as  an  arrow  or  flashing  bar). 

A  direct  cause  of  an  event  is  the  actions  or  conditions  immediately  preceding  the  event 
that  caused  or  allowed  it  to  occur. 

The  direct  cause  of  an  error  is  the  actions  or  conditions  immediately  preceding  the  error 
that  caused  or  allowed  the  error  to  occur.  Direct  causes  of  errors  are  also  known  as 
performance-shaping  factors. 

A  test  has  discriminate  validity  if  it  differentiates  between  workers  who  have  mastered 
KSAs  required  to  perform  the  job  and  those  who  have  not. 

A  display  is  a  specific  integrated,  organized  set  of  information.  A  display  can  include 
several  display  formats  (such  as  a  system  mimic  which  includes  bar  charts,  trend  graphs, 
and  data  fields). 

A  display  device  is  the  hardware  used  to  present  the  display  to  users.  Examples  include 
video  display  units  and  speakers  for  system  messages. 

Display  elements  are  the  basic  components  used  to  make  up  display  formats,  such  as 
abbreviations,  labels,  icons,  symbols,  coding,  and  highlighting. 


Display  format  refers  to  the  general  class  of  information  presentation.  Examples  of 
general  classes  are  continuous  text  (such  as  a  procedure  display),  mimics  and  piping  and 
instrumentation  diagram  (P&ID)  displays,  trend  graphs,  and  flowcharts. 

A  display  network  is  a  group  of  display  pages  within  an  information  system  and  their 
organizational  structure. 

A  display  page  is  a  defined  set  of  information  that  is  intended  to  be  displayed  as  a  single 
unit.  Typical  display  pages  in  a  nuclear  power  plant  may  combine  several  different 
formats  on  a  single  VDU  screen,  such  as  putting  bar  charts  and  digital  displays  in  a 
graphic  P&ID  format.  Display  pages  typically  have  a  label  and  designation  within  the 
computer  system  so  operators  can  assess  them  as  a  single  display. 

Documentary  evidence  includes  paper  and  electronic  information,  such  as  records, 
reports,  procedures,  work  orders,  memoranda,  and  vendor  manuals. 

Evidence  reliability  refers  to  whether  or  not  different  investigators  would  be  able  to  find 
the  same  information  and  reach  the  same  conclusions  from  it.  Conflicting  stories  from 
different  interviewees  is  an  example  of  unreliable  evidence  that  requires  further 
validation. 

Evidence  validity  refers  to  the  accuracy  of  the  information  gathered  in  the  course  of  an 
investigation.  Valid  evidence  is  information  gathered  from  more  than  one  source  that 
supports  the  “truth”  of  an  assertion. 

Functional  requirements  analysis  and  allocation  is  an  analysis  for  identifying  the 
plant’s  safety  functional  requirements  and  ensuring  that  the  functions  have  been  allocated 
to  support  an  acceptable  role  for  plant  personnel. 

A  general  organizational  improvement  plan  is  developed  by  plant  or  corporate  senior 
management  and  is  intended  to  make  significant  changes  in  how  work  is  done  and  how  it 
is  managed  in  order  to  improve  operational  performance  and  to  reverse  declining 
performance  trends. 

The  Help  function  in  a  software  program  refers  to  features  that  provide  guidance  to  the 
user  (e.g.,  describes  how  the  user  interface  works). 

HFE  program  is  a  plan  for  ensuring  that  HFE  considerations  will  be  integrated  into  the 
development,  design,  evaluation,  and  implementation  of  the  HSI. 

Housekeeping  refers  to  activities  performed  to  maintain  a  clean  and  orderly  work 
environment. 

HSI  design  is  the  systematic  application  of  HFE  principles  and  criteria  to  translate  the 
user's  function  and  task  requirements  into  the  details  of  the  HSI  design.  It  includes  the 


use  of  HFE  tests,  evaluations,  guidelines,  and  design  documentation  in  the  development 
of  the  HSI  design. 

Human  errors  are  inappropriate  or  inadequate  human  actions,  including  failures  to  take 
action  when  required. 

Human  factors  is  a  body  of  scientific  facts  about  human  characteristics.  The  term 
covers  all  biomedical,  psychological,  and  psychosocial  considerations;  it  includes,  but  is 
not  limited  to,  principles  and  applications  in  the  areas  of  human  factors  engineering, 
personnel  selection,  training,  job  performance  aids,  and  human  performance  evaluation. 

Human  factors  engineering  (HFE)  is  the  application  of  knowledge  about  human 
capabilities  and  limitations  to  the  design  of  a  plant,  system,  and  equipment.  HFE  ensures 
that  such  designs,  human  tasks,  and  work  environment  are  compatible  with  the  sensory, 
perceptual,  cognitive,  and  physical  attributes  of  the  personnel  who  operate,  maintain,  and 
support  them  (See  human  factors). 

A  human  performance  problem  is  a  term  used  to  collectively  refer  to  human  errors  and 
human  performance  trends. 

A  human  performance  trend  is  a  pattern  of  related  errors  resulting  from  the  same 
causal  factor(s). 

Human  reliability  analysis  is  an  analysis  of  the  human  error  mechanisms  relevant  to  the 
design  of  the  HSI,  procedures,  staffing,  and  training  to  reduce  their  likelihood  and 
consequences. 

Human-system  interface  (HSI)  is  the  means  through  which  personnel  interact  with  the 
plant,  including  the  alarms,  displays,  controls,  and  job-performance  aids.  Generically, 
this  also  includes  maintenance,  test,  and  inspection  interfaces. 

Impairment  refers  to  decrements  in  cognitive  and  physical  capabilities  that  are  usually 
the  result  of  substance  abuse,  fatigue,  illness,  stress  or  other  factors  that  temporarily 
affect  an  individual’s  ability  to  perform  tasks. 

Information  is  organized  data  that  users  need  to  successfully  perform  their  tasks. 
Information  can  include  (a)  a  representation  of  facts,  concepts,  or  instructions  in  a 
formalized  manner  suitable  for  communication,  interpretation,  or  processing  by  humans 
or  automatic  means;  and  (b)  any  representations,  such  as  characters  or  analog  quantities, 
to  which  meaning  is,  or  might  be,  assigned. 

Integrated  system  validation  entails  performance-based  evaluations  conducted  to  ensure 
that  the  integration  of  the  HSI,  procedures,  and  training  adequately  supports  plant 
personnel  in  the  safe  operation  of  the  plant. 


An  intermediate  corrective  action  plan  is  more  limited  in  scope  than  a  general 
organizational  improvement  plan  and  focuses  on  erecting  or  strengthening  barriers  to 
human  performance  problems. 

Investigation  methods  are  the  techniques  used  to  gather  evidence  about  an  event. 
Investigation  methods  include  establishing  and  pursuing  lines  of  inquiry  about  the  event 
by  gathering  physical,  documentary  and  testamentary  evidence. 

A  job  and  task  analysis  (JTA)  is  the  process  used  to  systematically  determine  the  jobs 
that  are  assigned  to  workers  and  the  tasks  that  must  be  performed  in  order  to  satisfactorily 
complete  the  job. 

Just-in-time  training  is  training  that  is  provided  to  workers  immediately  prior  to 
performing  the  job. 

Knowledge  is  a  set  of  facts,  factual  information,  a  method  of  analysis  or  the  application 
of  methods  and  facts  to  successfully  perform  a  task. 

KSAs  are  the  knowledge,  skills  and  abilities  required  for  a  job  incumbent  to  safely  and 
competently  perform  a  job. 

Labeling  and  marking  refer  to  the  use  of  labels  and  demarcations  to  identify  units  of 
equipment,  modules,  components,  and  parts. 

Learning  objectives  provide  a  brief  description  of  the  training  course  material  that  must 
be  taught  by  the  training  program  to  ensure  mastery  of  all  KSAs  required  to  perform  a 
certain  job,  task  or  to  meet  a  training  requirement. 

Limited  scope  corrective  action  plans  focus  on  fixing  the  direct  cause  of  an  error.  For 
example,  a  limited  scope  corrective  action  for  an  ambiguous  step  in  a  procedure  that 
confused  a  worker  and  caused  her  to  commit  an  error  would  be  to  revise  that  step  in  the 
procedure. 

A  local  control  station  (LCS)  is  an  operator  interface  related  to  nuclear  power  plant 
process  control  that  is  not  located  in  the  main  control  room.  This  includes  multifunction 
panels,  as  well  as  single-function  LCSs,  such  as  controls  (e.g.,  valves,  switches,  and 
breakers)  and  displays  (e.g.,  meters)  that  are  operated  or  consulted  during  normal, 
abnormal,  or  emergency  operations. 

Maintainability  refers  to  the  design  of  equipment  to  support  effective  and  efficient 
maintenance  activities. 

Managing  displays  refers  to  actions  performed  by  a  user  to  control  the  way  that 
individual  displays  are  presented  on  a  device. 


Managing  errors  refers  to  actions  performed  by  a  user  to  prevent,  detect,  or  correct 
errors. 

Managing  information  refers  to  the  capabilities  of  software  that  allow  the  user  to  create, 
change,  store,  and  retrieve  documents  via  the  computer. 

Mastery  is  the  process  of  achieving  the  requisite  knowledge,  skills  and  abilities  to 
perform  a  job  or  task  safely  and  competently. 

A  mental  lapse  is  a  momentary  gap  in  recall  for  the  correct  knowledge  or  ability  when  it 
is  required  to  perform  a  job. 

National  Nuclear  Accrediting  Board  is  a  body  of  experts  chartered  by  the  Institute  of 
Nuclear  Power  Operations  (INPO)  to  review,  accept  and  accredit  the  training  programs  at 
every  nuclear  power  station. 

An  operating  experience  review  is  a  review  of  relevant  operating  history  from  the 
plant’s  on-going  collection,  analysis,  and  documentation  of  operating  experiences. 

Operational  validity  ensures  that  test  items  address  the  mental  and  psychomotor 
activities  that  are  performed  on  the  job. 

Performance-based  training  (PBT),  also  called  the  Systematic  Approach  to  Training, 
includes  the  following  five  elements: 

1  Systematic  analysis  of  the  jobs  to  be  performed 

2  Learning  objectives  derived  from  the  analysis,  which  describe  desired 
performance  after  training 

3  Training  design  and  implementation  based  on  the  learning  objectives 

4  Evaluation  of  trainee  mastery  of  the  objectives  during  training 

5  Evaluation  and  revision  of  the  training  based  on  the  performance  of  trained 
personnel  in  the  job  setting. 

Personal  protective  equipment  (PPE)  is  equipment  worn  by  a  worker  to  minimize 
exposure  to  specific  occupational  hazards.  Examples  of  PPE  are  respirators,  gloves, 
aprons,  fall  protection,  and  full  body  suits,  as  well  as  head,  eye  and  foot  protection. 

Physical  evidence  is  matter  related  to  the  event,  such  as  equipment,  parts,  debris,  liquids, 
hardware  or  tools. 

Procedures  development  refers  to  the  integration  of  HFE  principles  and  criteria  in  a 
procedure  development  program  to  ensure  that  the  resulting  procedures:  (1)  support  and 
guide  human  interaction  with  plant  systems  and  plant-related  events  and  activities,  and 
(2)  are  technically  accurate,  comprehensive,  explicit,  easy  to  use,  and  validated. 

A  programmatic  cause  is  a  deficiency  in  one  of  the  licensee’s  policies,  programs  and 
processes  for  managing  work  activities  at  a  site  that  allows  human  errors  to  occur.  For 


example,  a  deficiency  in  a  licensee’s  training  program  could  set  the  stage  for  errors 
because  workers  may  not  have  the  knowledge  or  required  skills  to  perform  a  job 
correctly. 

The  root  cause  of  an  event  is  the  actions  or  set  of  conditions  that,  if  eliminated  or 
modified,  would  keep  the  event  from  recurring  as  well  as  prevent  similar  events  from 
occurring.  A  root  cause  is  often  responsible  for  multiple  human  errors  or  hardware 
failures,  rather  than  single  problems  or  faults.  Root  causes  are  more  fundamental  causes 
than  direct  causes,  and  are  typically  programmatic  or  management  weaknesses. 

Root  cause  analysis  is  a  structured,  repeatable,  systematic  method  for  synthesizing 
information  about  an  event  and  its  causal  factors  to  identify  the  critical  set  of  conditions 
that,  if  eliminated  or  modified,  would  prevent  the  same  event  and  similar  events  from 
recurring. 

Service  points  are  equipment  locations  used  for  performing  routine  maintenance  tasks, 
such  as  adjusting,  cleaning,  or  replacing  components. 

A  loss  of  situational  awareness  occurs  when  a  worker  has  mastered  the  relevant 
knowledge,  but  fails  to  recognize  that  the  knowledge  applies  to  the  task  at  time  of 
performance. 

A  skill  is  a  motor  or  mental  capability  such  as  the  ability  to  open  a  valve  or  operate  a 
controller. 

A  soft  control  is  a  control  device  that  has  connections  with  the  control  or  display  system 
mediated  by  software  rather  than  direct  physical  connections.  As  a  result,  the  functions 
of  a  soft  control  may  be  variable  and  context-dependent  rather  than  statically  defined. 
Also,  the  location  of  a  soft  control  may  be  virtual  (e.g.,  within  the  display  system 
structure)  rather  than  spatially  dedicated.  Soft  controls  include  devices  activated  from 
display  devices  (e.g.,  buttons  and  sliders  on  touch  screens),  multi-function  control 
devices  (e.g.,  knobs,  buttons,  keyboard  keys,  and  switches  that  perform  different 
functions  depending  upon  the  current  condition  of  the  plant,  the  control  system,  or  the 
HSI),  and  devices  activated  via  voice  input. 

Span  of  control  refers  to  the  personnel  and  functions  for  which  a  job  incumbent  has 
responsibility  and  authority.  Higher  management  positions  within  an  organization  have 
broader  spans  of  control. 

Staffing  is  the  process  of  accessing,  maintaining  and  scheduling  the  personnel  resources 
needed  to  accomplish  work  under  normal  and  foreseeable  off-normal  conditions. 

Staffing  decisions  consider  regulatory  requirements,  operating  costs,  the  range  of 
expertise  required,  the  number  of  staff  needed  and  scheduling. 


A  staffing  analysis  is  a  systematic  analysis  of  the  requirements  for  the  number  and 
qualifications  of  personnel  based  on  an  understanding  of  task  and  applicable  regulatory 
requirements. 

Stress  is  a  psychological  and  physiological  response  to  a  threatening  situation.  A 
threatening  situation  is  one  that  an  individual  has  appraised  as  exceeding  his  or  her 
capabilities  to  cope.  Stressful  situations,  or  stressors,  may  be  emotional,  cognitive, 
environmental  or  physiological. 

System  response  refers  to  the  manner  in  which  the  computer  system  behaves  after 
receiving  inputs  from  the  user. 

System  security  refers  to  features  that  restrict  personnel  access  to  aspects  of  the 
computer  system  to  prevent  accidental  or  deliberate  damage. 

Systematic  Approach  to  Training  (SAT)  -  See  performance-based  training. 

Task  analysis  is  a  method  of  detailing  the  components  of  a  task  in  terms  of  the  demands 
placed  upon  the  human  operator,  the  information  required  by  the  operator,  the  extent  to 
which  the  task  requires  reliance  on  or  coordination  with  other  personnel,  and  the  relation 
of  the  task  to  other  tasks. 

The  task  environment  refers  to  the  physical  conditions  in  which  work  is  performed,  such 
a  noise  and  illumination  levels,  temperature,  or  radiation. 

Task  overload  occurs  when  the  number  of  tasks  to  be  performed  in  a  given  period  of 
time  exceeds  the  available  personnel  resources.  Task  overload  may  increase  stress  and 
often  results  in  the  application  of  various  work  management  strategies.  These  strategies 
may  include  task  deferral,  delegation  or  increasing  the  work  pace,  all  of  which  may  result 
in  errors. 

Testamentary  evidence  includes  witness  statements  and  the  results  of  interviews. 

Test  equipment  refers  to  diagnostic  tools  used  to  assess  the  status  of  equipment  and 
locate  faults  that  may  be  present. 

Test  points  are  equipment  locations  used  for  conducting  tests  to  determine  the 
operational  status  of  equipment  and  for  isolating  malfunctions.  Test  equipment  may  be 
connected  at  these  points. 

Training  development  refers  to  the  use  of  a  systematic  approach  in  the  development  of 
personnel  training. 

User-system  interaction  refers  to  the  set  of  methods  provided  in  a  computer  system 
through  which  personnel  and  the  computer  communicate  with  each  other. 


Validation  is:  (1)  The  process  of  determining  whether  the  design  of  machine  elements 
and  the  organizational  design  of  human  elements  of  a  human-machine  system  are 
adequate  to  support  effective  integrated  performance  of  established  functions.  (2)  The 
capability  of  a  system  to  check  information  entry  items  for  correct  content  of  format  as 
defined  by  software  logic. 

Verification  is  the  process  of  determining  whether  procedures,  instrumentation,  controls, 
and  other  equipment  meet  the  specific  requirements  of  the  tasks  performed  by  personnel. 
The  term  is  used  in  the  following  contexts: 

HSI  task  support  verification:  The  individual  HSI  components  (e.g.,  control 
and  display  devices)  and  characteristics  (range,  accuracy,  and  safety  grade) 
needed  for  the  task  are  compared  to  those  actually  provided  in  the  work 
environment. 

HFE  design  verification:  The  characteristics  of  the  HSI,  workplace,  and  HSI 
support  functions  are  reviewed  by  the  licensee  to  determine  whether  their  design 
is  consistent  with  accepted  HFE  principles,  guidelines,  and  standards. 

Human  factors  issue  resolution  verification:  A  check  to  ensure  that  the  HFE 
issues  identified  during  the  design  process  have  been  acceptably  addressed  and 
resolved. 

A  workstation  is  the  physical  console  at  which  a  user  performs  tasks. 
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